I’m interested in disallowing the following after logout:
— no back button
— no direct access to pages via URL – for example: if the user logs out then they should not be allowed to see a cached page using some URL (e.g., replacing the URL with a valid URL in the site http://mysite.com/Gotothispage.aspx)
I’ve seen similar questions like this one: How to disable the back button in browser when user logout in asp.net c#
I know that I can set no cache on the master page, but then I lose the ability to use the back button when the user is actually logged in. Am I correct in this understanding?
A page is either cacheable or it isn’t, the browser has no idea if you are logged in or not. You can’t somehow retrospectively expire objects already cached by the browser.