Disabling browser's back functionality on sign out from Asp.Net

After sign out from site if browsers back button is clicked it shows the previous page, though user is sign out from the site, to avoid this disabling of cache is done

Download demo project - 9 Kb

Introduction

Disabling the Back Button

When i was doing coding for sign in and sign out for my clients application, i found that after signing out from the application i transfered the control to login page e.g. login.aspx. At this point if i click the Back button of Browser it shows the content of previous page user was viewing.

As there was important data displayed on page it is security threat.

It is a threat for web applications displaying important information like credit card numbers or bank account details.

I tried to find the solution on net but could not get satisfactory answer.

On searching i found following problem, and i think it is important to share this issue-

What happens when Back Button clicked

When we visit a page it is stored in a cache i.e. history on a local machine. Whenever user clicks the Back button, previous page is taken from this cache and displayed; request does not go to the server to check the login information as page is found on local cache. If we submit the page or refresh the page then only page is sent to the server side.

Caching-

Caching of Web Pages can happen in three separate entities in a Web environment.

When you think about caching, you usually think about the Web pages cached locally in your temporary Internet files of the profile that was used to log into local machine as a result of having visited the page.
But caching can also occur within the Internet Information Server (IIS) Server, and
If a proxy server is present, it can be configured to cache the pages.

Solution-

To avoid the displaying of page on click of back button we have to remove it from cache, or have to tell the server not to cache this page.

So if we do not cache the page then on click of back button request goes to server side and validation can be done whether session exist's or not.

This can be achieved by adding following code in the page load of the page for which we do not want to cache the page in history.

Response.Buffer=<SPAN style="COLOR: blue">true;<o:p></o:p>
Response.ExpiresAbsolute=DateTime.Now.AddDays(-1d);
Response.Expires =-1500;
Response.CacheControl = "no-cache";
 if(Session["SessionId"] == null)
    {
	Response.Redirect ("WdetLogin.aspx");
    }
}

Code in Detail-

Response.ExpiresAbsolute=DateTime.Now.AddDays(-1d);

In this instead of giving the current date we gave the date in the past so it confirms the expiration of page. So that allowing for time differences, rather than specify a static date. If your page is being viewed by a browser in a very different time-zone.

Response.Expires = -1500;

Some IIS internals experts revealed this can be a very touchy parameter to rely upon and usually requires a rather"large" negative number or pedantically, that would be a very small number.

Response.CacheControl = "no-cache";

It tells the browser not to cache the page.

Things can work with only one line of code

i.e. Response.CacheControl = "no-cache";

But it is good practice to delete the existing page from cache.

This code will tell the server not to cache this page, due to this when user clicks the Back button browser will not find the page in cache and then will go to server side to get the page.

Disabling cache can also be done by adding following line in Meta section of page

<METAHTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">

But when I tried this it does not worked for me.

Proxy Server Caching-

Response.CacheControl = "private";

It disables the proxy server caching and page is cached on local machine.

Response.CacheControl = "public";

Proxy server cache is enabled.

Users request pages from a local server instead of direct from the source.

So if the information displayed is critical information extra care should be taken to remove the page from cache on sign out.

Hence for such applications keeping pages non caching is good solution.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

About the Author

RohitDighe

Web Developer

India

Member

Rohit Dighe
B.E. Computer from University of Pune, India.

Working on Asp.Net and C# from 2 years

Article Top

Poor

Excellent

Add a reason or comment to your vote: x
Votes of 3 or less require a comment

Comments and Discussions

You must Sign In to use this message board. (secure sign-in)

Search this forum
	Profile popups Noise Layout Per page

Thanks

Sayantan Adhikari

19:34 11 Jul '11

Thank u,for your good explanation helped me a lot.
Sign In·View Thread·Permalink

thank u so much buddy

suganthr

21:23 25 May '11

Thank u so much
Sign In·View Thread·Permalink

My vote of 1

Kriish05

20:33 28 Nov '10

If u just handle session is engough to prevent back button in IE but even ur code is not working in Mozilla Firox. Pls check n if u get solution pls frop mail to kriish05@yahoo.com. Thanking you
Sign In·View Thread·Permalink

Great!!!

minhhieu_dotnet

22:51 16 Nov '10

Thanks so much
Sign In·View Thread·Permalink

My vote of 5

vijayaragavanvv

18:25 7 Oct '10

Great
Sign In·View Thread·Permalink

My vote of 1

Hemant026

20:54 14 Nov '09

not working even with internet explorer
Sign In·View Thread·Permalink

My vote of 2

Member 2992582

19:23 3 Nov '09

It wont works on Firefox.....
Sign In·View Thread·Permalink

This is a good and usefull article... Thanks..

Pajosh83

20:44 16 Jul '09

This is a good and usefull article... Thanks..
Sign In·View Thread·Permalink

Session Variables and Back Functionality after Logout.........

vijay.victory

3:22 15 Apr '09

Hi Experts,

I m working on my website which have facility to create user accounts.
As any user logged in to system, Session Variables also created and maintaind
for further use and for authentication purpos offcourse..!

Now My problem is When the user LOGOUT , he cannot able to go on
previously visited page.!

and my doubts are :

1> If i use this code ,then is it affect my session variables or session ID.

 2> I have used the code as like :-

Session.Clear();
        Session.Abandon();
        Response.Redirect("Login.aspx");

   but I can go back to previously visited page and my sessionID also does not change.

and the main thing to note that the user can use the session variables on that page.

and ofcourse send the legal request to server..and unfortunately server respond it as current user request.



 3> I cannot use the no-cache or noStore method to disable Back functionality.

    due to database application and some image on my page..

    If I use the No-cacheing method then for each visit to page the images/large data

    should be taken from server and it may be slowdown the performance of site.

Plz Help me..
i m waitng for ur valuable reply..

I have never failed,I just found 1000 ways that never works.
Regards,
Victory.

Not working in Mozilla sometime

.NET- India

22:12 3 Mar '08

First of all thnx a lot for your such a good post. But friend it is not working at it's best in Mozilla but running perfectly in Internet Explorer... Can you tell me what is this problem
Sign In·View Thread·Permalink	3.83/5 (5 votes)

thank you

snopbear

2:45 9 Feb '08

it works good i work with this for 1 year ago but with the master page some times redirect and logout without press the logout button ..... so what the problem is ?
Sign In·View Thread·Permalink	5.00/5 (1 vote)

doesnt work twith mozilla

durbich

5:04 11 Sep '07

i think your code doesnt work with mozilla browser. Thanks in advance dddd
Sign In·View Thread·Permalink	4.00/5 (3 votes)

What at the End

hsr2107

3:52 29 Jul '06

I tried this but on clicking the back button it's going to the previous page. How to stop that??????????????????????????????????.Pls mail me if you have solution.............
Sign In·View Thread·Permalink	2.67/5 (5 votes)

Opera?

TomazZ

23:04 17 Jul '06

What about Opera browser? This two lines works for IE and FireFox but not for Opera: System.Web.HttpContext.Current.Response.Expires =-1500; System.Web.HttpContext.Current.Response.Cache.SetNoStore(); TomazZ
Sign In·View Thread·Permalink	2.00/5 (1 vote)

Can be original.

hellomeandme

5:38 14 Jun '06

I hate to point this out but some excerpts in this article are word by word plagiarized from a similar one by Phil Paxton and John Sheppard. Kindly try to use your own ideas and phrases while writing up any article. Thanks, New2.Net
Sign In·View Thread·Permalink

Re: Can be original.

hspc

0:01 17 May '07

Can you post a link to the original article? Hesham A. Amin My blog
Sign In·View Thread·Permalink

Re: Can be original.

kuyak2000

17:50 8 Jul '07

I think he's quite right, but the article is not exactly the same word by word. This is the link of the original Phil Paxton article: http://www.learnasp.com/freebook/asp/cachenomore.aspx Sad but true, the guy is right.
Sign In·View Thread·Permalink

Good for Beginner Re:Disabling browser's back functionality on sign out from Asp.Net

jeya1981

0:18 29 May '06

Hi all, I am just new to this DotNet field. I am created a login control for my web pages. But i am stuck with this problem. After reading this article, i ve made it. It works good with IE. Thanks Code project team...and all. Regars, Jay
Sign In·View Thread·Permalink

Re:Disabling browser's back functionality on sign out from Asp.Net

winheart

21:39 21 Feb '06

hai The values in the cache is not going, exspecially in firefox. waste program. Put some updated code for working in firefox and ie. or i should recommend to remove this article codes from this page
Sign In·View Thread·Permalink	1.00/5 (1 vote)

Re:Disabling browser's back functionality on sign out from Asp.Net

Aftab Naveed

3:05 19 Jul '06

I think you should appreciate the efforts made by the indivisuals You can just Ask If its not supporting the FireFox,

Any ways here is the code for both FireFox and Internet Explorer I have tested this on both and it worked for me

//############# Removes page from Cache Even if Browsers Back Button is pressed
Response.Buffer=true;
Response.ExpiresAbsolute=DateTime.Now.AddDays(-1d);
Response.Expires = -1500;
Response.CacheControl ="no-cache";
Response.Cache.SetNoStore();
//#####################################################################

Disabling caching on the back button

db..

1:05 12 Aug '05

I believe the correct method to use in .NET is

Response.Cache.SetNoStore();

Seems to work for me. If you logout then go back to the previously displayed page, there is a server round trip.

Additionally, when logging out you should use
Session.Abandon();
Session.Redirect("Login.aspx");

instead of Session["loggedIn"] = false;

Session.Abandon() makes sure all session variables are cleared and a new session commences (on the next page, hence the redirect.

Re: Disabling caching on the back button

weblech

0:41 19 Nov '08

I works on FF, but unfortunately not on Opera. Still, thanks a lot.
Sign In·View Thread·Permalink

Re: Disabling caching on the back button

vikastrust2005

1:57 2 Sep '11

Thanks a lot ,this code( Response.Cache.SetNoStore();) works with every browser. really helped me.
Sign In·View Thread·Permalink

Back Button won't come from Server!

JJF007

5:00 5 Aug '05

If you use the back button first the client cache will be showed (as i know not for script/dynamic generated pages).

If the page will be showed while using ASP the server has some problems with the security handling of the user. Every Page you show should have a handler in the PageLoad where you check the Login State of the User and if required redirect him to a new Login Page/Error Page. This works fine.

Re: Back Button won't come from Server!

darisole

6:18 5 Aug '05

Usually I use that method:

you can set a Session["..."] variable to use for checking the user's login status.

Login ---> Session["LoginDone"] = true;

Logout ---> Session["LoginDone"] = false;

Page_Load(...) {

if(Session["LoginDone"] == null || Session["LoginDone"] == false) {
Response.Redirect("Login.aspx");
}

}

if the browser shows the page in its cache no problem: it contains 'legal' data.
if it tries to load the page from the server, a new login is needed.