473,770 Members | 1,994 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Prevent accessing page via browser history

Have a "standard" asp.net web solution which uses the standard asp.net
authentication and authorization methods (forms authentication) .

Some users have raised concern that even if you logout (which brings
the user back to the login.aspx page) you can seemingly navigate back
in via the back-button and the browser history.

If user A is viewing a page and then clicks logout and leaves (browser
not at login.aspx). User B comes along and can easily click "back" in
the browser to see what user A was doing.

One way around this would be to prevent client-side caching by the
browser, but I dont want to remove the users ability to use "back" and
"forward".

I'm considering making some javascript that via AJAX check with the
server onLoad that the session is still valid. This means that each
page request results in yet another server call. Another option could
perhaps be checking for a cookie that I delete when logging out.

Any tips? How have you solved this problem?
Feb 25 '08 #1
2 2845
you need to set nocache on. back will still work, the browser will just hit
the server again. code your pages to handle this case. put a trans guid in
each pages viewstate so you can detect a "cache" hit.

-- bruce (sqlwork.com)
"PÃ¥l A." wrote:
Have a "standard" asp.net web solution which uses the standard asp.net
authentication and authorization methods (forms authentication) .

Some users have raised concern that even if you logout (which brings
the user back to the login.aspx page) you can seemingly navigate back
in via the back-button and the browser history.

If user A is viewing a page and then clicks logout and leaves (browser
not at login.aspx). User B comes along and can easily click "back" in
the browser to see what user A was doing.

One way around this would be to prevent client-side caching by the
browser, but I dont want to remove the users ability to use "back" and
"forward".

I'm considering making some javascript that via AJAX check with the
server onLoad that the session is still valid. This means that each
page request results in yet another server call. Another option could
perhaps be checking for a cookie that I delete when logging out.

Any tips? How have you solved this problem?
Feb 25 '08 #2
On Feb 25, 5:34 pm, bruce barker
<brucebar...@di scussions.micro soft.comwrote:
you need to set nocache on. back will still work, the browser will just hit
the server again. code your pages to handle this case. put a trans guid in
each pages viewstate so you can detect a "cache" hit.
Won't going "back" to a page with nocache cause a re-post? Most all
pages in asp.net have some sort of postback on them. Having a trans
guid or ticket or what ever and only act when the ticket is valid is a
nice option, but not something I want to implement on an existing
system.
Feb 25 '08 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

0
1592
by: Mark Petersen | last post by:
Is there a way to prevent a page postback from being added to the browser history without using SmartNavigation? I'd like to be able to do this in a cross-browser compatible way (modern standards-compliant browsers). I've seen tons of articles on how to maintain scroll position and focus, but what about this other feature of SmartNavigation? Anyone know of a base page class that could accomplish this? Or do I have to wait for Whidbey?
3
10034
by: Rob | last post by:
Each time a webform is posted back (submitted), another URL is added to the browser's history list. My web application allows a back button to return to previously visited pages, but I do not wish to return to each Postback URL, but rather only the initial page URL. Is there a way to prevent Postback URL's from being added to the browser's history list Thanks in advance for any help.
3
5306
by: laryten | last post by:
Hi, Is there a way to update the same web page instead of getting a new page each time we click the submit button? The simplest thing to do is to delete the current page (or go back to the previous page) and then redraw the page. There are a few possible solutions: 1. Use the same URL again. But a new page will still be created. 2. Use the "onsubmit" option:
0
1628
by: =?Utf-8?B?bWtlbGx5NGNh?= | last post by:
I've spent quite some time searching for a way to prevent the browser from adding each of my postbacks to the History list, and have found several different methods to do that or something similar, all of which either don't do what I need or don't work at all. The closest solution is to enable SmartNavigation, but it causes my first postback to effectively be ignored, and it adds that first page view to the history. If I could figure out...
3
2047
by: Phil | last post by:
Jerry posed some good ideas, a while back, on website a security issue that comes up often. Gary Jones was asking how to keep users from directly accessing php pages, out of sequence. Jerry posed a directory management solution. No one seems to have mentioned an alternative. Maybe there is a reason? We took a different approach, noting that the only way we wanted a user to enter some phps would be through a predefined series of steps...
1
1584
by: =?Utf-8?B?UmljaGFyZA==?= | last post by:
Hi, After the user is signed out and taken to the login page, they can still use the back & history features in the browser to access pages. Every page (except login) has a check at the beginning to redirect the user after being logged out, but when the page is accessed via back button, the debugger doesn't stop at that code b/c the page is cached and is not generated at the server. How can I make these pages disappear from the...
10
10497
Ajm113
by: Ajm113 | last post by:
Making a History Page for BIG Sites Intro: Ok, let's say after a while your website has grown massive. We're talking search engine, forum and video hosting -- you've got a LOT of content. And you are wondering, "Why do I need yet another feature for my big site?" Well, some people can become forgetful every time they see content on your site, and let's suppose that one day they needed to work on a good php script for their class and they...
2
3434
by: Max | last post by:
I recently moved to ASPnet Ext 3.5 What I can't get with Ajax and History browser managemet is this: User fills some fields (dropdown and textbox) on page 1 (all are in an update panel) User clicks Submit Button I write the data into a DB I add a history point with ScriptManager to be able to get back to this point with browser back button Page 2 is loaded with a response.redirect() command
5
3657
by: Eric | last post by:
Hi, the user gets a form to fill. All the filled values are put into session variables. I want to prevent that he could click to the previous arrow of the browser and then comes back to the form. Is that possible with asp.net? Or, is it possible to clear the session when leaving the form page by clicking the previous arrow?
0
9618
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
10259
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
1
10038
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
8933
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
6710
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5354
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
5482
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
4007
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
3609
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.