Question

I have a logout action method. I am already setting no-cache but still it brings in data from cache. This is my method:

public ActionResult Logout()
        {
            FormsAuthentication.SignOut();

            // clear authentication cookie
            HttpCookie cookie1 = new HttpCookie(FormsAuthentication.FormsCookieName, "");
            cookie1.Expires = DateTime.Now.AddYears(-1);
            Response.Cookies.Add(cookie1);

            // clear session cookie (not necessary for your current problem but i would recommend you do it anyway)
            HttpCookie cookie2 = new HttpCookie("ASP.NET_SessionId", "");
            cookie2.Expires = DateTime.Now.AddYears(-1);
            Response.Cookies.Add(cookie2);
            Session.Abandon();

            Response.Cache.SetCacheability(HttpCacheability.NoCache);
            Response.Cache.SetExpires(DateTime.Now.AddSeconds(-1));
            Response.Cache.SetNoStore();
            Response.AppendHeader("Pragma", "no-cache");

            return RedirectToAction("Login", "Account");
        }

I click on logout, I get redirected to login page. Then when I hit browser back button, I can still see the authenticated page but when I refresh I am again redirected to login page. Can anybody tell me what am I doing wrong?

Answer 1

Add following code in your actions

   // to clear cache problems
        this.Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(-1));
        this.Response.Cache.SetCacheability(HttpCacheability.NoCache);
        this.Response.Cache.SetNoStore();