Question

I have created a simple login page for asp.net which takes in user name and password in text boxes and compare it with the one I have stored in database and redirects only if it is same as stored in database.

But what is happening is that when I login and then go back by pressing back button, then again pressing forward button of browser,it is still redirecting users.

So can anyone help with this issue as to as once logged out,it should redirect only after entering credentials and not by pressing forward button of the browser.

protected void LoginButton_Click(object sender, EventArgs e)
    {
        int results = 0;
        if (txtUsername.Text != "" && txtPassword.Text != "")
        {
            results = Validate_Login(txtUsername.Text, txtPassword.Text);
        }
        else
        {
            lblMessage.Text = "Please make sure that the username and the password is Correct";
        }
        if (results == 1)
        {
            if (txtUsername.Text.Equals("admin"))
            {
                Response.Redirect("~/ConfigurationPage.aspx");
            }
            else
            {
                Response.Redirect("");
            }
        }
        else
        {
            lblMessage.Text = "Invalid Login";
            lblMessage.ForeColor = System.Drawing.Color.Red;
        }
    }

    public int Validate_Login(String username, String password)
    {
        var conString = ConfigurationManager.ConnectionStrings["ConnectionString"];
        string strConnString = conString.ConnectionString;
        int results = 0;

        using (SqlCommand cmdselect = new SqlCommand
                                   {
                                       CommandType = CommandType.StoredProcedure,
                                       CommandText = "[dbo].[prcLoginv]"
                                   })
        {

            cmdselect.Parameters.Add("@Username", SqlDbType.VarChar, 50).Value = username;
            cmdselect.Parameters.Add("@UPassword", SqlDbType.VarChar, 50).Value = password;
            cmdselect.Parameters.Add("@OutRes", SqlDbType.Int, 4);

            cmdselect.Parameters["@OutRes"].Direction = ParameterDirection.Output;



            try
            {
                if (connection == null)
                {
                    connection = new SqlConnection(strConnString);
                    connection.Open();
                    cmdselect.Connection = connection;
                    cmdselect.ExecuteNonQuery();
                    results = (int) cmdselect.Parameters["@OutRes"].Value;
                }
                else if (connection.State == ConnectionState.Closed)
                {
                    connection.Open();
                    cmdselect.ExecuteNonQuery();
                    results = (int) cmdselect.Parameters["@OutRes"].Value;
                }

            }
            catch (SqlException ex)
            {
                lblMessage.Text = ex.Message;
            }
            finally
            {
                if (connection != null)
                {
                    connection.Close();
                }
            }
        }
        return results;
    }

Answer 1

I have had this scenario in the past. In reality, nothing happens in the server when you press the back and forward button. So what I usually do is to also check on the client (I check the Session variables in the client):

<script>
    var isLogged = '<%=Session["Logged"] %>';
    if (isLogged != 'True') {
        window.location.href = 'About.aspx';
    }
</script>

That was just a simple example. Please notice though, that it does not matter if the person can click the back or forward button, as soon as a postback happens they will be taken out of that page.

Good luck!