I’ve got a strange one to solve today. A client needs their site to not allow people being logged in, going to a different site, then still being logged in if they hit the back button in their browser.
Simple I thought… until I couldn’t find a page event that got fired when the back button was pressed from another site.
I thought of just using JavaScript and working with the referrer object, but this won’t achieve my goal as I need to access the .NET Membership system and log the user out of their session.
Has anyone got around this problem? If so, how? Any help would be appreciated, potentially I’m just missing something that I could achieve in the Global.asax? If it helps, I’m using .NET 4.5 / C#.
Reasoning:
Due to, say, if one operator went and left their machine unlocked, visited Google, then another operator went on the same machine maliciously and hit the back button to gain access to that operator’s logon (the client is very security cautious)
So you would like to log out user whenever they leave your site? You cah have global javascript that sends a request to a server every minute saying “Hey, server, I’m here! I’m user Joe Blogs, i’m still on the site”. If the server does not get this message from a user longer than a minute, log them out.
Overriding back button is just not going to work. What would you do if user opens up another tab/window and goes to google there?
Update:
you can try using .unload() from jquery to catch page leave. And destroy the cookies on that event.
However, when the machine is just left unattended, nothing stop malicious user to go grab the access.
Update 2 you can just set very short session life! if user is inactive (or left the page) – log them out. To prevent possible annoyance for logging out when user looking on the screen for too long (fills in very long form) – make javascript to do regular (every 5 minutes) to a server to a dummy page – to keep the session live while the page is loaded.
Here is the source: Force users to logout when they leave my php website?