Member Avatar for kamilacbe

Hi ..

i have a login page which performs some operation and finally when i log-out that page it has close all the session and navigate to the home page , but then when i click back button in IE it should not post back the page again..

thanks in advance

  • 3 Contributors
  • 5 Replies
  • 192 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by websoftcreation

Dani AI

Generated

The problem is browser caching: clearing server-side session data alone doesn’t stop the browser from showing a cached copy when the Back button is used. was correct to suggest checking the session on page load, and was right to recommend clearing the session. A robust solution combines (1) server-side session cleanup, (2) explicit removal of auth/session cookies, and (3) cache-control headers so protected pages are not served from the browser cache.

Example logout handler (WebForms, C#):

protected void Logout_Click(object sender, EventArgs e)
{
    // server-side
    Session.Clear();
    Session.Abandon();

    // clear Forms auth cookie (if used)
    System.Web.Security.FormsAuthentication.SignOut();

    // expire the session cookie so the client discards it
    if (Request.Cookies["ASP.NET_SessionId"] != null)
    {
        var c = new HttpCookie("ASP.NET_SessionId", "") { Expires = DateTime.Now.AddDays(-1) };
        Response.Cookies.Add(c);
    }

    Response.Redirect("~/Default.aspx");
}

Add cache and session checks to every protected page (or centrally via a base page, master page, or HTTP module) so Back will force a reload and redirect when the session is gone:

protected void Page_Load(object sender, EventArgs e)
{
    Response.Cache.SetCacheability(HttpCacheability.NoCache);
    Response.Cache.SetNoStore();
    Response.Cache.SetExpires(DateTime.UtcNow.AddSeconds(-1));
    Response.Cache.SetMaxAge(TimeSpan.Zero);

    if (Session["UserId"] == null) Response.Redirect("~/Login.aspx");
}

Notes and checklist:

  • Session.Abandon() + clearing the session cookie prevents reuse of the old session id.
  • If Forms Authentication is used, call FormsAuthentication.SignOut() and expire that cookie.
  • For MVC use [OutputCache(NoStore=true, Duration=0, VaryByParam="*")] on actions or central middleware.
  • Implement the checks in a shared place (base page or global filter) to avoid missing pages.
  • Browser behavior varies; cache headers above are the practical way to stop back-button display of protected content.

As confirmed by , combining these steps prevents the back-button from showing the logged-in page after logout.

Recommended Answers

All 5 Replies

Member Avatar for hericles

Call the Session.Clear() method when the log out code is complete (but before the redirect to the home page). This will clear out all session values regardless of whether the back button is clicked - as long as each page checks for an active session anyway.

Edited by hericles because: n/a
Member Avatar for kamilacbe

hi .

can give me an example..because i have cleared the session before transferring my page ..but then when I click the back button it shows the data..

Thanks ...

Edited by kamilacbe because: n/a
Member Avatar for hericles

Does the page you go back to check to see if a valid session is active?
In the page load part of the page check for whatever session variable shows the user is logged in. If it exists or is set to the correct value continue to load the page. If not then redirect to the home page or login screen. Once you have cleared the session this page won't display even by pushing the back button

Member Avatar for kamilacbe

hi hericles,

its working :-) Thank you...

Member Avatar for websoftcreation

Hi ,

You can do this very easily.Just use session.clear() method and redirect to login page.

From
websoftcreation,jaipur

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.