Question

I’m using Forms authentication. I have a small problem after the user logs out. If he hits the back button after he logs out, he’s sent to the page he was on when he was logged in.

What is the best way to prevent that? I’ve looked around but it doesn’t seem that there’s one definitive approach. Ideally, I’m thinking I’d like to have a function on the master page or even in an httpmodule that checks to see if the user is logged in and if not, redirect him to the login. Is that the best way to do it?

Thanks.

Answer 1

As long as you do Session.Abandon() and FormsAuthentication.SignOut() on your Logout page it doesn’t matter whether the user can go back to the previous page he was in, the moment he clicks on anything will be redirected to the Login page.

Example:

Page_Load login/logout page:

if (!IsPostBack)
{
       FormsAuthentication.SignOut();
       Session.Abandon();
}