Question

My application is in Asp.Net MVC3, i have two Users(Admin and general).Im maintaining the cookies of the Logged In users.

Below is my Cookie code.

 public static void setCookiestring Password ,string UserName)
 {
     HttpCookie MyCookie= new HttpCookie("MyCookies");
     MyCookie["Password"] = Password;
     MyCookie["UserName"] = UserName;
     MyCookie.Expires.Add(new TimeSpan(0,30,0));
     HttpContext.Current.Response.Cookies.Add(MyCookies);
 }

Below is code of how my cookie Expires when user Logs Out

public static bool logout()
        {
            HttpCookie MyCookie= new HttpCookie("MyCookies");

            MyCookie.Expires = DateTime.UtcNow.AddDays(-1);
            HttpContext.Current.Response.Cookies.Add(MyCookies);
            return true;
        }

I have tried to check the Cookie on every Index() of Controller.If the Cookie exists it should navigate to desired page else it should go to Home.

 if (!Cookie.CheckCookie())
    {
       //use the current url for the redirect       
       filterContext.HttpContext.Response.Redirect("~/Home/Index", true);
    } 

When the user clicks Log Out they are Redirected to Home,but after clicking Back button,the last visited page is can be viewed.
What can i do so that when the user clicks on LogOut and if they click back button they should still get Redirected to Home and not to Last Visited Page.
Please Suggest

Answer 1

One way to prevent this is to exclude all authenticated pages from being cached on the client side by setting the appropriate response headers. You may take a look at the following post for an example of an action filter that you could apply to the authenticated part of your site.