Alex Rivera | Logout

Is there a way to keep a page from rendering once a person has logged out but hit the "back" button?

Asked 2008-09-15T15:41:42.620
23

I have some website which requires a logon and shows sensitive information.

The person goes to the page, is prompted to log in, then gets to see the information.

The person logs out of the site, and is redirected back to the login page.

The person then can hit "back" and go right back to the page where the sensitive information is contained. Since the browser just thinks of it as rendered HTML, it shows it to them no problem.

Is there a way to prevent that information from being displayed when the person hits the "back" button from the logged out screen? I'm not trying to disable the back button itself, I'm just trying to keep the sensitive information from being displayed again because the person is not logged into the site anymore.

For the sake of argument, the above site/scenario is in ASP.NET with Forms Authentication (so when the user goes to the first page, which is the page they want, they're redirected to the logon page - in case that makes a difference).

asp.net security browser caching back-button
Edit
Report

3 Answers

0

You are looking for a no-cache directive:

<META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">

If you've got a master page design going, this may be a little bit of a juggle, but I believe you can put this directive on a single page, without affecting the rest of your site (assuming that's what you want).

If you've got this directive set, the browser will dutifully head back to the server looking for a brand new copy of the page, which will cause your server to see that the user is not authenticated and bump him to the login page.

answered 2008-09-15T15:44:29.917
0

Well, in a major brazilian bank corporation (Banco do Brasil) which is known by having one of the world´s most secure and efficient home banking software, they simply put history.go(1) in every page.So, if you hit the back button, you will be returned. Simple.

answered 2008-09-15T18:13:40.743
0

Please look into the HTTP response headers. Most of the ASP code that people are posting looks to be setting those. Be sure.

The chipmunk book from O'Reilly is the bible of HTTP, and Chris Shiflett's HTTP book is good as well.

answered 2008-09-20T06:00:40.347

Your Answer