Some users can't log in; others can log in but can't submit forms

Question

I run a site and once in a while users contact me because they either can't log in, or can log in but have problems submitting forms (the forms are on protected pages, using PHP sessions). Until now, I've been able to tell users to just switch browsers, and the problem cleared up: I figured that it was some sort of browser issue since it wasn't every user who was having this issue. Further, all problem users were using IE. I then thought that perhaps it was an IE specific problem until a new user had the same issue on Chrome/Firefox (I logged into the users account on 2 different machines and was not able to replicate the Chrome/Firefox issue).

After doing some digging, I now think the problem might be session related. This site says that:

Older cache files and cookies also need to be cleared before you visit secure areas like a payment portal or a shopping cart. “Session expired” is a common notification if old browser cache and cookies haven’t been junked.

After doing some further digging on Stackoverflow, I found a community wiki started by @BalusC saying that the proper way to avoid caching a page via php would be to use:

header('Cache-Control: no-cache, no-store, must-revalidate'); // HTTP 1.1.
header('Pragma: no-cache'); // HTTP 1.0.
header('Expires: 0'); // Proxies.

With the above in mind, I have a couple of questions:

1. Would I just put the above code on my login screen? It would seem to me that if I put it on any page where the user were logged in, then they would be logged out since the session won't be cached.
2. If I use a CDN (CLoudflare), would their caching process override what I write on the specific page?

Thanks!

EDIT:

My login page is as follows:

<div id="login_form">
<form id="login" method="post">
<?php $login_problem = FALSE;
       if (isset($_POST['signin']) && $failed) {
                  $login_problem = TRUE;
                  $login_error_result ='<a href="/admin/forgotten.php">Forget something?</a>';
        }
 ?>
<table>
<tr>
<td>
<label for="username">Username:</label>
<input name="username" id="username" type="text" maxlength="15" />
</td>
<td colspan="2"><label for="password">Password: <?php if ($login_problem) {
                          echo $login_error_result;}?></label>
<input type="password" id="password" name="password"  maxlength="15"/>
</td>
<td id="login_submit" >
<input  type="submit" name="signin" class="submit" value="Sign in!" />
</td>
</tr>
</table>
</form>
    </div>

Answer 1

I too run a website which allows users to login and navigate protected pages. Personally I use cookies for the process, but the PHP session is in essence a cookie with the name phpsessid. Here are the PHP headers that I use to prevent caching:

header("Cache-control: no-store, no-cache, must-revalidate");
header("Expires: Mon, 26 Jun 1997 05:00:00 GMT");
header("Pragma: no-cache");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");

When writing out my anchor tags for site navigation, I use echo "$anchorTagLink?cacheBuster=" . time();

This seems to effectively prevent caching because the page itself sends a message basically saying, "Don't cache me!" and each link is a new unique link.

CloudFlare can influence caching because they can stream back a cached copy of your page; however, I believe this is adjustable in the CloudFlare settings (though I'm not 100% sure).

---

EDIT:

Here are some details on PHP Cache Control: http://css-tricks.com/snippets/php/intelligent-php-cache-control/

Answer 2

I think it could also be a javascript issue, sometimes the javascript could be disabled on chrome or IE. You could try to disable javascript and see what happens. You can add NO-CACHE on login page only. Though i have tested NO_Cache and it doesn't always seem to work.

On your login page do you have javascript validation or php validation?