backbutton

Are you asking this as a follow up to your prior question about security? You're trying to prevent anyone from seeing the last page the user was on before logging out?

Is so, you're asking all the same questions everyone else asks. Unfortunately, there's NO good fix. You can try to block the back button with client side Javascript. Even if you succeeded in coming up with Javascript to override the user's effort to use the back button, they have other options. They can modify or turn off your Javascript. They can use the browser history to go back instead. You can't completely block the user from seeing the last cached page in the browser with Javascript. You can make it harder, but you can't stop it.

If you really want security, you have to put this in your code:

Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetExpires(DateTime.Now); //or a date much earlier than current time

This keeps the browser from caching your page. YOur performance is worse, but it's the only way to really secure your page. The user can still hit the back button, but there's nothing cached for the user to see when he goes back.

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Suthish Nair15y ago
thread resolved?
Suthish Nair15y ago
paste the code and try...

protected override void OnPreRender(EventArgs e)
   {
   base.OnPreRender(e);
   string strDisAbleBackButton;
   strDisAbleBackButton = "";
   ClientScript.RegisterClientScriptBlock(this.Page.GetType(), "clientScript", strDisAbleBackButton);
   }
Andrew Fenster15y ago
Are you asking this as a follow up to your prior question about security? You're trying to prevent anyone from seeing the last page the user was on before logging out?

Is so, you're asking all the same questions everyone else asks. Unfortunately, there's NO good fix. You can try to block the back button with client side Javascript. Even if you succeeded in coming up with Javascript to override the user's effort to use the back button, they have other options. They can modify or turn off your Javascript. They can use the browser history to go back instead. You can't completely block the user from seeing the last cached page in the browser with Javascript. You can make it harder, but you can't stop it.

If you really want security, you have to put this in your code:

Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetExpires(DateTime.Now); //or a date much earlier than current time

This keeps the browser from caching your page. YOur performance is worse, but it's the only way to really secure your page. The user can still hit the back button, but there's nothing cached for the user to see when he goes back.