How Disable Browser Back Button only after Logout in mvc3.net

Question

I am using FormsAuthentication for userlogin. I am having a problem after user logs out successfuly the back button is browser allows user to view pages. I tried using javascript

 <script type = "text/javascript" >
        function preventBack() { window.history.forward(1); }
        setTimeout("preventBack()", 0);
        window.onunload = function () { null };
</script>

But back button is completly disabled. It worked bt,I dont want to disable back button functionality when user is logged in. i want my LOGGED IN user to use browser back button as normal. But once he choosed to log out, he is not allow to see any of contents by pressing Back. I also tried using

Session.Abandon();
 Response.Cache.SetCacheability(HttpCacheability.NoCache);
 Response.Cache.SetExpires(DateTime.Now);

But this is also not working.how do I fix this?

Assiut

I suspect this would be a bad idea, since the user could just disable javascript and then press the back button. – Tarra

Answer 1

You could clear the browser history when the user logs out:

var url = window.location.href;
window.history.go(-window.history.length);
window.location.href = url;

However this would not be particularly robust - it relies on javascript, it would not work across multiple tabs and may only serve to annoy the user. IMO the best bet is to set appropriate caching headers such that the browser will not cache any of your 'logged in' pages via a NoCacheAttribute applied appropriately:

public class NoCacheAttribute : ActionFilterAttribute
{  
  public override void OnResultExecuting(ResultExecutingContext filterContext)
  {
      filterContext.HttpContext.Response.Cache.SetExpires(DateTime.UtcNow.AddDays(-1));
      filterContext.HttpContext.Response.Cache.SetValidUntilExpires(false);
      filterContext.HttpContext.Response.Cache.SetRevalidation(HttpCacheRevalidation.AllCaches);
      filterContext.HttpContext.Response.Cache.SetCacheability(HttpCacheability.NoCache);
      filterContext.HttpContext.Response.Cache.SetNoStore();

      base.OnResultExecuting(filterContext);
  }
}

Liederkranz

how do we use this ? Can you give an example How do I call this in a logout method ? def /logout.html end – Manvell

@Manvell have a look at asp.net/mvc/tutorials/older-versions/controllers-and-routing/… for an introduction to ActionFilters. NB this approach would not be appropriate for requests that bypass the ASP.Net MVC processing pipeline (eg for static files). – Clareclarence

@RichO'Kelly I am using this over my Logout action method but it is not working and my method just clears the session and redirects to home page – Cent

@RichO'Kelly I have made it work and the action filter is getting executed but still after pressing back button i can access the previous page so i don't think the cache is getting cleared – Cent

@mohit Apologies for delay - missed your comments. The attribute needs to be applied to all the pages that are only accessible whilst logged in - applying it when the logout action is executed will have no effect. – Clareclarence

@RichO'Kelly Is there anyway to clear the cache while logging out – Cent

@mohit Not easily. Browsers cache things according to the HTTP headers that are in the response to a request. Those requests and responses have already been and gone by the time the user clicks logout. – Clareclarence

Answer 2

Use this code in the html page on which you need to control the back button.

$().ready(function() {
    if(document.referrer != 'http://localhost:8181/'){ 
        history.pushState(null, null, 'login');
        window.addEventListener('popstate', function () {
            history.pushState(null, null, 'login');
        });
    }
});

This code will block back button event. The if condition is for allowing the back button if the previous page is 'http://localhost:8181/'. Back button won't be working if the previous page is not 'http://localhost:8181/'. If you need to block all previous pages then avoid the if condition. The history.pushState statements will replace the url on the browser address bar to 'login'. So I recommend you to change 'login' with your page url.

Advantages of this method:-

1. No need to control the cache.
2. We could allow the back button event for specified previous pages and could block the rest.

Hoping my answer will help someone.

Heavierthanair

Really useful. Thanks – Colville

Great help thanks, I had to include it into my Login Razor! Brilliant – Recessional

Answer 3

Disabling back button is not a right way to achieve your need. Instead you can add the following three tags in your html file, which takes care of clearing cache.

<META Http-Equiv="Cache-Control" Content="no-cache">
<META Http-Equiv="Pragma" Content="no-cache">
<META Http-Equiv="Expires" Content="0">

Insupportable

in which html we have to put this one? – Detrain

Inside a html file which you don't want to cache. But if you are looking for a way not to cache any file at all, then you should update your server configuration to not to cache[in http header]. – Insupportable

is it possible to do it like that, when we reach a particular page, all cache should be deleted. like when we reach login page, all cache should be deleted. – Detrain

Server can control the cache time of the resources its sending to client from no-cache to 5 mins, 1 day, 1 week or according to your need. But forcing the browser to clear its cache is not possible from server side. – Insupportable

Answer 4

The easiest way I found is using OutputCache Attribute

[OutputCache(NoStore = true, Duration = 0, VaryByParam = "*")]
public class HomeController  : Controller
{
}

Grillwork

do we have to use this on all controllers? – Detrain

Yes. But if you want it to set globally, then look at the selected answer above. – Grillwork

Answer 5

 <script language="JavaScript" type="text/javascript">
    window.history.forward();              
 </script> 

Textile

Answer 6

Please go through the article http://www.aspdotnet-suresh.com/2011/11/disable-browser-back-button.html . I used the javacript function provided by the author in my layout page to prevent back button issue , as i need to provide access to certain pages to all visitors of my website.

This solution worked for me in IE 11 and Chrome Version 43.0.2357.130 m.

Hope this helps.

Secrecy

Answer 7

var url = window.history.forward();
window.history.go(-window.history.length);

Kingcraft

You should probably add some explanation to your answer. Best regards – Kimberelykimberlee

Answer 8

If you want this for all your pages, you could write in your Global.asax:

protected void Application_BeginRequest()
{
Response.AddHeader("Cache-Control", "no-cache, no-store, must-revalidate");
Response.AddHeader("Pragma", "no-cache");
Response.AddHeader("Expires", "0");
}

This will not cache any page of your site.

Vagus

Answer 9

Please use this code in your Master Page Load Event.

if(!IsPostBack)
        {
            if (Session["LoginId"] == null)
                Response.Redirect("frmLogin.aspx");
            else
            {
                Response.ClearHeaders();
                Response.AddHeader("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate");
                Response.AddHeader("Pragma", "no-cache");
                            }
        }

Hope it helps! :)

Referee