Member Avatar for vyruzxxx21

Hi there, I just wanna know if....How others make their web pages not to be remembered in the address bar? Just like if you're using a computer from another location and your accessing a secure page....and when you closed your browser, the url of the page won't be listed in the address bar. Anybody knows how to do that? Tnx in Advance.

  • 4 Contributors
  • 3 Replies
  • 322 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by RobUK

Dani AI

Generated

Brief answer first: the browser decides what gets kept in its history, so the server can’t absolutely force an address bar entry to never appear. That said, there are practical patterns you can use so sensitive data never appears there and so the visible URL left after a session is "clean." This builds on points made by , and the IE-era comment from , but gives usable, modern steps.

Use POST and server-side sessions (never put secrets in query strings). After authentication, follow the Post/Redirect/Get pattern so the user ends up on a clean URL instead of one containing form data or tokens. Also send cache-control headers to discourage browsers/proxies from storing sensitive responses. Example (classic ASP sketch):

<%
' after successful login
Session("UserID") = userID
Response.AddHeader "Cache-Control","no-store, no-cache, must-revalidate"
Response.AddHeader "Pragma","no-cache"
Response.Expires = -1
Response.Redirect "Dashboard.asp"
%>

On the client, replace or rewrite the history entry so a sensitive URL is not left behind. Modern browsers support the History API; a simple replace will swap the current history entry without creating a new one:

<script>
  history.replaceState(null,'','/dashboard');
  // or use location.replace('/dashboard') to navigate without adding history
</script>

Additional important practices: use HTTPS, set session cookies with Secure and HttpOnly, regenerate session identifiers on login (to avoid fixation), expire and clear sessions on logout, and set form fields’ autocomplete="off" where appropriate. For users on public machines, recommend private/incognito mode or instruct them to explicitly close the browser and clear history — those are client actions only. Ignore old IE-only hacks (.htc) today; the History API + server-side hygiene is the reliable, cross-browser approach.

Recommended Answers

All 3 Replies

Member Avatar for Drew

That is a browser setting and there is no way in ASP to hide your URL from the history.

Member Avatar for samaru

Like Drew just said, it's impossible to do. If you want security, protect each page by creating sessions based on id/password.

Member Avatar for RobUK

Hi,

You are talking about a client side function of the browser software.
ASP, and in fact all server side languages can effect no change in client side behaviours, and hence, you are a little stuck.

It may be possible using a client side scripting language, but most likely ONLY for internet explorer, and only by use of an .htc behavior file.

Dont ask me how you would write the .htc , but there's your answer.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.