Setting content expiration on all pages to avoid back button in ASP Classic

Question

Is there a way to set pages to expire in ASP Classic so that the user can't hit back and re-do anything?

Is this a good practice?

Answer 1

If you force the page to 'expire', it would have the opposite effect you want: It would actually force the browser to make the request again (because it's been told the data it has expired)

I suspect you might be barking up the wrong tree here, though. Are the pages that "do stuff" using the Query String values as the parameters to take those actions? In other words, is the page that links to the 'action' page doing so via a regular anchor tag with query string parameters in the URL, or via a form using the GET method?

If so, you should change the form submitting that action to a POST form. Doing that will not only result in a prompt in the browser if the person uses the Back or Refresh buttons to try to reload that page, but also helps protect you against Cross-Site Request Forgery attacks. (more info on XSRF here)

Answer 2

What is the problem that you are trying to solve? If the back button is forcing something to be updated on the server, then you are better off making sure that you don't allow pages to be in the browser history that can cause problems.

After a POST, I often do a Response.Redirect so that the POST is not in the browser history. This helps avoid these types of issues.