In my website I’ve two pages called First.aspx and second.aspx.
From first.aspx I’m redirecting user to second.aspx clicking upon a link.
In second.aspx page, I’m using javascript:history.back() on click of a cancel input button (not asp button). This is done to avoid reloading of last page as user has not done anything on this page, and clicked on cancel to go back to the previous page.
I’m wondering whether there are any security issues or any other issues related to using this history.back()? If so, what kind of issues are they?
Instead of this, should I use asp button and redirect back to first page using response.redirect()? Which one is better approach?
I suggest to avoid the history.back() except for some rare using page that you can not do otherwise.
Why to avoid.
First reason is the case that a user open a new page, or save this page (and open it later) and have no previous page to go. With that way he can not go to “cancel page”.
Also there is the case that some one else from other page redirect him to your page (maybe this is a security issue ?) This case also the cancel return him to the previous page… Some time search sites open your page in a frame to just show a photo from your page, also this is a case the the .back maybe not work properly.
Second reason, the go back is not correctly working when you have ajax calls/updates and must be handle with different way.
Third reason is that the cache of the page is not depend from the go back or from the redirect. On both cases the page can be reload or not, this is depend from what you have set on the header of the page, and how browser handle it.
And also there is the case that the user do not have javascript (or have it disable), or the javascript product an error and not working for any random reason.
And one more also very important. If you have make post back on the previous page, then the go back, is generate again post back ! You need to redirect him to the previous page.
Hope this help.