Disabling browser's back functionality on sign out from Asp.Net

Announcements

	Try Azure, win a laptop
	Build a VS2010 addin win a Zune
	Monthly Competition

Articles

Platforms, Frameworks & Libraries

Languages

General Programming

Graphics / Design

Development Lifecycle

Services

CodeProject VS2008 Addin

Feature Zones

Product Showcase

WhitePapers / Webcasts

.NET Dev Library

Cloud Hosting Resources

ASP.NET Web Hosting

Advanced Search
Add to IE Search

Discuss

Report

28 votes for this article.

Popularity: 3.65 Rating: 2.52 out of 5

Download demo project - 9 Kb

Introduction

Disabling the Back Button

When i was doing coding for sign in and sign out for my clients application, i found that after signing out from the application i transfered the control to login page e.g. login.aspx. At this point if i click the Back button of Browser it shows the content of previous page user was viewing.

As there was important data displayed on page it is security threat.

It is a threat for web applications displaying important information like credit card numbers or bank account details.

I tried to find the solution on net but could not get satisfactory answer.

On searching i found following problem, and i think it is important to share this issue-

What happens when Back Button clicked

When we visit a page it is stored in a cache i.e. history on a local machine. Whenever user clicks the Back button, previous page is taken from this cache and displayed; request does not go to the server to check the login information as page is found on local cache. If we submit the page or refresh the page then only page is sent to the server side.

Caching-

Caching of Web Pages can happen in three separate entities in a Web environment.

When you think about caching, you usually think about the Web pages cached locally in your temporary Internet files of the profile that was used to log into local machine as a result of having visited the page.
But caching can also occur within the Internet Information Server (IIS) Server, and
If a proxy server is present, it can be configured to cache the pages.

Solution-

To avoid the displaying of page on click of back button we have to remove it from cache, or have to tell the server not to cache this page.

So if we do not cache the page then on click of back button request goes to server side and validation can be done whether session exist's or not.

This can be achieved by adding following code in the page load of the page for which we do not want to cache the page in history.

Response.Buffer=<SPAN style="COLOR: blue">true;<o:p></o:p>
Response.ExpiresAbsolute=DateTime.Now.AddDays(-1d);
Response.Expires =-1500;
Response.CacheControl = "no-cache";
 if(Session["SessionId"] == null)
    {
	Response.Redirect ("WdetLogin.aspx");
    }
}

Code in Detail-

Response.ExpiresAbsolute=DateTime.Now.AddDays(-1d);

In this instead of giving the current date we gave the date in the past so it confirms the expiration of page. So that allowing for time differences, rather than specify a static date. If your page is being viewed by a browser in a very different time-zone.

Response.Expires = -1500;

Some IIS internals experts revealed this can be a very touchy parameter to rely upon and usually requires a rather"large" negative number or pedantically, that would be a very small number.

Response.CacheControl = "no-cache";

It tells the browser not to cache the page.

Things can work with only one line of code

i.e. Response.CacheControl = "no-cache";

But it is good practice to delete the existing page from cache.

This code will tell the server not to cache this page, due to this when user clicks the Back button browser will not find the page in cache and then will go to server side to get the page.

Disabling cache can also be done by adding following line in Meta section of page

<METAHTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">

But when I tried this it does not worked for me.

Proxy Server Caching-

Response.CacheControl = "private";

It disables the proxy server caching and page is cached on local machine.

Response.CacheControl = "public";

Proxy server cache is enabled.

Users request pages from a local server instead of direct from the source.

So if the information displayed is critical information extra care should be taken to remove the page from cache on sign out.

Hence for such applications keeping pages non caching is good solution.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

About the Author

RohitDighe

Member

Rohit Dighe
B.E. Computer from University of Pune, India.

Working on Asp.Net and C# from 2 years

Occupation:	Web Developer
Location:	India

Other popular ASP.NET articles:

Multiple File Upload With Progress Bar Using Flash and ASP.NET
How to use Flash to upload multiple files in a medium-trust hosting environment
Exploring Session in ASP.Net
This article describe about session in ASP.Net 2.0 . Different Types of Session , There Configuration . Also describe Session on Web Farm , Load balancer , web garden etc.
CAPTCHA Image
Using CAPTCHA images to prevent automated form submission.
10 ASP.NET Performance and Scalability Secrets
10 easy ways to make ASP.NET and AJAX websites faster, more scalable and support more traffic at lower cost
Paging of Large Resultsets in ASP.NET
An article about optimization and performance testing of MS SQL Server 2000 stored procedures used for paging of large resultsets in ASP.NET

Article Top

You must Sign In to use this message board.

FAQ
Noise Tolerance Layout Per page

My vote of 1

Hemant026

21:54 14 Nov '09

not working even with internet explorer
Sign In·View Thread·PermaLink

My vote of 2

Member 2992582

20:23 3 Nov '09

It wont works on Firefox.....
Sign In·View Thread·PermaLink

This is a good and usefull article... Thanks..

Pajosh83

21:44 16 Jul '09

This is a good and usefull article... Thanks..
Sign In·View Thread·PermaLink

Session Variables and Back Functionality after Logout.........

vijay.victory

4:22 15 Apr '09

Hi Experts,

I m working on my website which have facility to create user accounts.
As any user logged in to system, Session Variables also created and maintaind
for further use and for authentication purpos offcourse..!

Now My problem is When the user LOGOUT , he cannot able to go on
previously visited page.!

and my doubts are :

1> If i use this code ,then is it affect my session variables or session ID.
 2> I have used the code as like :-

Session.Clear();
        Session.Abandon();
        Response.Redirect("Login.aspx");

   but I can go back to previously visited page and my sessionID also does not change.
and the main thing to note that the user can use the session variables on that page.
and ofcourse send the legal request to server..and unfortunately server respond it as current user request.

 3> I cannot use the no-cache or noStore method to disable Back functionality.
    due to database application and some image on my page..
    If I use the No-cacheing method then for each visit to page the images/large data
    should be taken from server and it may be slowdown the performance of site.

Plz Help me..
i m waitng for ur valuable reply..

I have never failed,I just found 1000 ways that never works.
Regards,
Victory.

Not working in Mozilla sometime

.NET- India

23:12 3 Mar '08

First of all thnx a lot for your such a good post. But friend it is not working at it's best in Mozilla but running perfectly in Internet Explorer... Can you tell me what is this problem
Sign In·View Thread·PermaLink	3.25/5 (3 votes)

thank you

snopbear

3:45 9 Feb '08

it works good i work with this for 1 year ago but with the master page some times redirect and logout without press the logout button ..... so what the problem is ?
Sign In·View Thread·PermaLink

doesnt work twith mozilla

durbich

6:04 11 Sep '07

i think your code doesnt work with mozilla browser. Thanks in advance dddd
Sign In·View Thread·PermaLink	4.00/5 (3 votes)

What at the End

hsr2107

4:52 29 Jul '06

I tried this but on clicking the back button it's going to the previous page. How to stop that??????????????????????????????????.Pls mail me if you have solution.............
Sign In·View Thread·PermaLink	2.67/5 (5 votes)

Opera?

TomazZ

0:04 18 Jul '06

What about Opera browser? This two lines works for IE and FireFox but not for Opera: System.Web.HttpContext.Current.Response.Expires =-1500; System.Web.HttpContext.Current.Response.Cache.SetNoStore(); TomazZ
Sign In·View Thread·PermaLink	2.00/5 (1 vote)

Can be original.

hellomeandme

6:38 14 Jun '06

I hate to point this out but some excerpts in this article are word by word plagiarized from a similar one by Phil Paxton and John Sheppard. Kindly try to use your own ideas and phrases while writing up any article. Thanks, New2.Net
Sign In·View Thread·PermaLink

Re: Can be original.

hspc

1:01 17 May '07

Can you post a link to the original article? Hesham A. Amin My blog
Sign In·View Thread·PermaLink

Re: Can be original.

kuyak2000

18:50 8 Jul '07

I think he's quite right, but the article is not exactly the same word by word. This is the link of the original Phil Paxton article: http://www.learnasp.com/freebook/asp/cachenomore.aspx Sad but true, the guy is right.
Sign In·View Thread·PermaLink

Good for Beginner Re:Disabling browser's back functionality on sign out from Asp.Net

jeya1981

1:18 29 May '06

Hi all, I am just new to this DotNet field. I am created a login control for my web pages. But i am stuck with this problem. After reading this article, i ve made it. It works good with IE. Thanks Code project team...and all. Regars, Jay
Sign In·View Thread·PermaLink

Re:Disabling browser's back functionality on sign out from Asp.Net

winheart

22:39 21 Feb '06

hai The values in the cache is not going, exspecially in firefox. waste program. Put some updated code for working in firefox and ie. or i should recommend to remove this article codes from this page
Sign In·View Thread·PermaLink

Re:Disabling browser's back functionality on sign out from Asp.Net

Aftab Naveed

4:05 19 Jul '06

I think you should appreciate the efforts made by the indivisuals You can just Ask If its not supporting the FireFox,

Any ways here is the code for both FireFox and Internet Explorer I have tested this on both and it worked for me

//############# Removes page from Cache Even if Browsers Back Button is pressed
Response.Buffer=true;
Response.ExpiresAbsolute=DateTime.Now.AddDays(-1d);
Response.Expires = -1500;
Response.CacheControl ="no-cache";
Response.Cache.SetNoStore();
//#####################################################################

Disabling caching on the back button

db..

2:05 12 Aug '05

I believe the correct method to use in .NET is

Response.Cache.SetNoStore();

Seems to work for me. If you logout then go back to the previously displayed page, there is a server round trip.

Additionally, when logging out you should use
Session.Abandon();
Session.Redirect("Login.aspx");

instead of Session["loggedIn"] = false;

Session.Abandon() makes sure all session variables are cleared and a new session commences (on the next page, hence the redirect.

Re: Disabling caching on the back button

weblech

1:41 19 Nov '08

I works on FF, but unfortunately not on Opera. Still, thanks a lot.
Sign In·View Thread·PermaLink

Back Button won't come from Server!

JJF007

6:00 5 Aug '05

If you use the back button first the client cache will be showed (as i know not for script/dynamic generated pages).

If the page will be showed while using ASP the server has some problems with the security handling of the user. Every Page you show should have a handler in the PageLoad where you check the Login State of the User and if required redirect him to a new Login Page/Error Page. This works fine.

Re: Back Button won't come from Server!

darisole

7:18 5 Aug '05

Usually I use that method:

you can set a Session["..."] variable to use for checking the user's login status.

Login ---> Session["LoginDone"] = true;

Logout ---> Session["LoginDone"] = false;

Page_Load(...) {

if(Session["LoginDone"] == null || Session["LoginDone"] == false) {
Response.Redirect("Login.aspx");
}

}

if the browser shows the page in its cache no problem: it contains 'legal' data.
if it tries to load the page from the server, a new login is needed.

Re: Back Button won't come from Server!

Rohit123dighe

20:57 7 Aug '05

If i am having sensitive information, then it creates problem.
Information like credit card numbers and others.

So if i use above method only and i forgot to close the browser before leaving the cyber cafe, then someone else can see the information.

As a developer we should always think of keeping the information hidden if user is not autheticated.

And even if cache is disabled we have to write above method then only server will show the login page.

So we need both the things.

RohitD

Re: Back Button won't come from Server!

darisole

22:33 7 Aug '05

I agree. I didn't thought about, for example, cyber cafe. I think also that, as a developer, you (and I) must repair users' errors, lapses and all the strange and stupud actions they usually do...
Sign In·View Thread·PermaLink	2.29/5 (6 votes)

Re: Back Button won't come from Server! [modified]

l.karimi.j

3:13 17 Oct '07

Hi thank for this file.I used from your file but if page contain a button that fill a gridview,when press back in browser you Receive an error(Webpage has expired). -- modified at 2:27 Thursday 18th October, 2007
Sign In·View Thread·PermaLink	2.14/5 (5 votes)

General News Question Answer Joke Rant Admin

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads.

PermaLink | Privacy | Terms of Use
Last Updated: 12 Aug 2005
Editor: