Warning: Page Has Expired

Question

I've added the following code to my masterpage (Page_Load) so once a user logs out they will not be able to use the back button to see the page they were previously at.

 Response.Buffer = true;
 Response.ExpiresAbsolute = DateTime.Now.AddDays(-1);
 Response.Expires = -1;
 Response.CacheControl = "no-cache";

The problem is, my users want to be able to use the browser back button while they are logged into the application. When I comment the code out to not cache the pages they can use the back button, but once they logout they can use the back button to see the previous page they were on which causes a security risk.

Does anyone have any suggestions so they can use the browser back button in the application but once they are logged out they cannot go back into the application?

Answer 1

See:

• http://stackoverflow.com/questions/87422/disabling-back-button-on-the-browser
• http://stackoverflow.com/questions/64059/is-there-a-way-to-keep-a-page-from-rendering-once-a-person-has-logged-out-but-h

Answer 2

Is the objective to prevent an un-authenticated user from surreptitiously visiting a previously-used computer and seeing what the authenticated user was doing? If the latter, then you should redirect the user to a logout page that has a window.close(); command along with strong language about this being a requirement. Now, this isn't ironclad: IE will ask the user if they are willing to let the app close the window and other browsers ignore the request altogether. However, in the right kind of security environment, I think that it does provide a significant addition to your security policy - albeit of a primarily cultural variety (it helps the members of the culture abide by the rules).

If you want "one-time through and you are done" type of security then I'm afraid that locking out the cache or adding "window.forward()" to every page (which prevents all use of the back button) is your only real option.

One other thing: AJAX provides some tools that help as well. You could put sensitive information on an update panel and have the page load javascript trigger an update panel refresh. Since this will always go back to the server, unauthenticated/expired users will be turned away. This is a pretty significant workload to take on but I thought I'd throw it out there.

Answer 3

YUI provides a way to easily control the browser's history to programmatically punch URLs into the history. Take a look at the YUI Browser History manager.