Back arrow after signing out

Question

I have an ASP.NET application using Forms Authentication. When the user clicks the Sign Out button on the page it runs the following code.

        FormsAuthentication.SignOut();
        Response.Expires = 0;
        Response.Cache.SetNoStore();
        Response.AppendHeader("Pragma", "no-cache");

However the user can still just press the back arrow and see the previous page without needing to log in again. I am sure it has something to do with the previous page being cached. How can I make sure they are prompted to log in again with going back?

Answer 1

And now you know why you get the message, "You've been logged out. Please close this browser window for security reasons."

No cache is a workaround.

The penultimate workaround is to use ajax to pull any sensitive information down - this would be run again in the back case, and the information should not be cached. It's more connections and more latency, but due to modern browser caching there's not much that can be done except workarounds such as these.

Answer 2

Response.Cache.SetCacheability(HttpCacheability.NoCache);

Answer 3

While caching is not guaranteed, this works for me for the most part

    //Used for disabling page caching
    HttpContext.Current.Response.Cache.SetExpires(
      DateTime.UtcNow.AddDays(-1));
    HttpContext.Current.Response.Cache.SetValidUntilExpires(false);
    HttpContext.Current.Response.Cache.SetRevalidation(
      HttpCacheRevalidation.AllCaches);
    HttpContext.Current.Response.Cache.SetCacheability(
      HttpCacheability.NoCache);
    HttpContext.Current.Response.Cache.SetNoStore();

Run this in any page's OnInit() method (maybe by using a base class) on any page you don't want the users to be able to cache.

Be careful though, some pages may require you to allow caching such as doing file downloads on SSL pages etc.

I found this code somewhere, if I find the link I'll update the post.