Please have a look at my blog post on this subject
This is because of caching on the browser and the way browser history works. The short answer to this question is
You don't disable the back button. The back button isn't yours to disable, it's part of my browser and I want it to work.
Usually when people post questions like this, it's because they don't understand how to control the flow of data from the site. In this case, the two things we are concerned with are authentication and caching.
So, add the caching directives to your pages and the user will be forced to reauthenticate before they can view your content again.