Issues with browsers BACK and FORWARD buttons

[rahulvasanth]

HI

I have developed a web site. In the web site, the user can see view his details if he has logged in. In case user has not logged in, then the login screen is displayed, where the user logs in . In the details page, if the user clicks on the browser BACK button, he is taken back to login screen, but the password is not displayed.

Now, the user can again click on the browser's FORWARD button to view the account details.

I don't want this to be working this way. Even if the user clicks FORWARD button, he should not be able to proceed to details page without entering the pasword in login screen.

How can I do this with ASP.NET ?

Thanking in Advance

[Shuja Ali]

The moment you redirect the user to the Login Page you should be clearing the Session variables. And all the other pages before displaying any data should check the session variables and if they are empty the user should then be taken back to the Login Page.

I am assuming that the once the user logs in a session variable is created for him/her which will be used through the application.

[rahulvasanth]

I m clearing all the session variables, but if the user clicks the BACK button provided by the IE on top, to go back to the login screen and again if the user clicks the FORWARD button provided by IE, the user can access the details page without logging in.

I want to avoid this,

Is there any way to capture the browser's BACK and FORWARD button click events ?

[Shuja Ali]

I m clearing all the session variables, but if the user clicks the BACK button provided by the IE on top, to go back to the login screen and again if the user clicks the FORWARD button provided by IE, the user can access the details page without logging in.

I want to avoid this,

Is there any way to capture the browser's BACK and FORWARD button click events ?

Did you try doing what is suggested in my previous post?

[AndyTheAce]

Clear your login session variable in pageload of your login.aspx.
Check this session in all your other modules, if its nothing redirect to login.

add these two lines of code in the pageload of each module you don't
want to allow to go by browers back/forward button:

Response.Cache.SetExpires(DateTime.Now.AddSeconds(-1))
Response.Cache.SetCacheability(HttpCacheability.NoCache)



Cheers,
Andy

[jasonli]

Actually, when user click "back" button to go to login webpage, server side code won't run. So it is useless to write code in page_load.

The better way is to set cookie for that. Because javascript code will run when the webpage is showing by whatever way.

the code in login.aspx:

window.onload = function(){	document.cookie='logged=;expires=Thu, 01-Jan-1970 00:00:01 GMT;';
	document.getElementById('hidLogged').value = 'false';
};
window.onunload=function()
{
	if (document.getElementById('hidLogged').value == 'true')
	{
		document.cookie='logged=true;';
	}
};

the code in default.aspx:

window.onload = function(){if(getCookie('logged') == null){window.location.assign('Login.aspx');return;};};

You can try that.

[AndyTheAce]

why is it useless?
The code is executed once you load the page, so browsers caching for that
page is no longer active.

Absolutly no need for javascript.

[rahulvasanth]

The page_load event is not triggered when I use the browser's BACK and FORWARD button

I think the browser loads the pages from its memory.

[Shuja Ali]

Yes the Browser usually cache the Pages and when the same page is asked it will load it from the Cache.

[jasonli]

Clear your login session variable in pageload of your login.aspx.
Check this session in all your other modules, if its nothing redirect to login.

add these two lines of code in the pageload of each module you don't
want to allow to go by browers back/forward button:

Response.Cache.SetExpires(DateTime.Now.AddSeconds(-1))
Response.Cache.SetCacheability(HttpCacheability.NoCache)



Cheers,
Andy

Andy's method does work. However, how can you do when you have many pages under security control. For example, after login you wanna go back to the first page from the second page, can you?