Question

I have developed a web application that processes credit card payments and when a user hits the back button in Fire Fox after they received the payment confirmation page, it post a duplicate payment.

I have put the following code in both the payment form and confirmation page and it still posts duplicate payments:

Response.Cache.SetExpires(DateTime.UtcNow.AddYears(-1));
Response.Cache.SetValidUntilExpires(false);
Response.Cache.SetRevalidation(HttpCacheRevalidation.AllCaches);
Response.Cache.SetAllowResponseInBrowserHistory(false);
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetNoStore();

What I am doing wrong and how can I resolve it?

Answer 1

rerun has a good point in the comments. With regards to this problem, try this code (source):

   Response.ClearHeaders();
   Response.AppendHeader("Cache-Control", "no-cache"); //HTTP 1.1
   Response.AppendHeader("Cache-Control", "private"); // HTTP 1.1
   Response.AppendHeader("Cache-Control", "no-store"); // HTTP 1.1
   Response.AppendHeader("Cache-Control", "must-revalidate"); // HTTP 1.1
   Response.AppendHeader("Cache-Control", "max-stale=0"); // HTTP 1.1 
   Response.AppendHeader("Cache-Control", "post-check=0"); // HTTP 1.1 
   Response.AppendHeader("Cache-Control", "pre-check=0"); // HTTP 1.1 
   Response.AppendHeader("Pragma", "no-cache"); // HTTP 1.1 
   Response.AppendHeader("Keep-Alive", "timeout=3, max=993"); // HTTP 1.1 
   Response.AppendHeader("Expires", "Mon, 26 Jul 1997 05:00:00 GMT"); // HTTP 1.1 

It should force all browsers to get the latest version and not the cached version of a page. (Might want to change the Expires data has that post was from 2006).