Howt to handle user's session when browser forward or back buttons are clicked in ASP.Net?

Question

After user logs-in to a website by authenticating using his credentials, if he clicks back button in browser and comes back to log-in page, then how to restrict the user when he tries to visit other pages with out providing the credentials again?

Answer 1

Whenever a user comes to the login page, remove the authentication cookie. This way, without the authentication cookie, the user won't be able to go to any other page.

But when the user clicks the back button, you'll have to write the following code in the login page's Page_Load method to disable caching -

Response.AddHeader("Expires", "-1");
Response.AddHeader("Cache-Control", "no-store, no-cache, must-revalidate");
Response.AddHeader("Pragma", "no-cache");

Answer 2

You must use this code, this avoids the caching of the page:

Response.CacheControl = "no-cache"
Response.AddHeader "Pragma", "no-cache"
Response.Expires = -1