Using The Browser's Back Button After SignOut() Allows Access To Secure Page (MVC)
Jan 25, 2010
I have an MVC app that uses [Authorize] to protect the private bits. When I select the SignOut() URL it signs me out but if I hit the back button on my browser the it goes to the secure page and even lets me use the form. The action takes place and then it shows that I'm signed out. The problem is that it performs the secured action (inserting a row into my database). Then I can use the back button again and do it all over. If I use the back button after logging out and hit the browser refresh it does show I'm logged out and refuses me access to the secure page. Am I missing something important? It seems like it could be a really big security issue.
public ActionResult LogOff(string ReturnUrl)
{
FormsAuth.SignOut();
if (!String.IsNullOrEmpty(ReturnUrl))
{
return Redirect(ReturnUrl);
}
else
{
return RedirectToAction("Index", "Page");
}
}
I have a Default(contains the sign-out button) and Login page, once the user is not authenticated, it will always redirect the user to login page.
So the scenario is when the user hit the sign-out button it will redirect him to the login page which is good. My problem is, when the user hits theprevious or back button from the login page,it will still read the authorization cookies and redirect him to the default page. which should not be the case. the user should be redirected to login page when authentication is invalid.
I've read some solutions on the net, but still it doesn't work for me. below are the codes I've used for my sign-out function
[Code]....
By the way, when the user is authenticated, the previous or back button is available/enable for the user.
From pageA, clicking a button to open pageB which display a crystal report. User can only use browser back button. How to open pageC from pageB? Can I add code in pageB close (if there is a page close event) or make back button in browser to open pageC instead of pageA?
From pageA, clicking a button to open pageB which display a crystal report. User can only use browser back button. How to open pageC from pageB? Can I add code in pageB close (if there is a page close event) or make back button in browser to open pageC instead of pageA?
am creating a web application in using c# with asp.net.
in that am using login page only as normal aspx page. other pages are using masterpage.
when i click logout button in masterpage. page will redirect to login page. after that if i click browser back button it was moving to previous page. how can i prevent this.
am using this following code in master page aspx page. And My log out button code is below.
I have an application that posts to a form on a different page, on a different site. Everything works fine unless the user presses the back button.The way it'ssetup now, if th euser forgets their pin, they click alink which takes them to a popup window. The enter their info and then they're sent a new pin. Fine.However, I'm trying to account for all possible scenarios. What if the user forgets their pin, is taken to this other page, and then decides they remembered their pina nd presses the back button. They'll need to reload in order to be able to try to post again, otherwise the session variables I'm using to log them in won't reset (I reset some in the page load event).Is there anyway to detect whether the page was arrived at via the browser back button so that I can reload it?
In the page there are two links. When i click the first link it opens a window in a new page. I do this by using the above code.
I am clicking the second link in the page and navigating to another page. Now i am clicking the browser back button. Supprisingly its opening the first link.
How clicking back button is opening the link in the page. I am using c# .net 2005.
I am using Ajax authentication service to login/logout users.And have 2 boxes one for logged users,another for any user.When user logged in he get loged in box,then go to another page,then press back,i have unlogged box.In Page_Load i check if (Reques.IsAuthenticated) then i change box on corresponding,in this case on Logged in box.But Page_Load is not called when i press button back(in browser) or backspace.
if users press the browser's back button to reach the prior page..then page should display a message like "web page expired" in asp.net can i use javascript for this?
for example..
there are 4 pages in web sites. 1,2 and 3 can be back. but when the 4th page run then 4th page can not be back... when the user press browser's back button , diaplay ma message "weg page expired".
When I click Logout page redirect to Login page but when click to browser arrow back then it will goes back, I want to after Logout cannot going to back page...
Possible Duplicate: Disabling Back button on the browser i want to disable browser back button without using javascript function forward().because it remain on this page.
I want to totally disable browser back button like banking sites
I have an image that has an on-click function. That on-click function calls an action method in a controller passing some values from the page, using window.location.replace.
[Code]....
The controller then gets data from the repository and displays a "printer friendly html" page:
Im using ASP.NET 2.0,C# for my web application development. I am having a login page and new user registration page. how to redirect to login page once user finishes his registration and clicks back button of browser. Registration page is container page using some master page..
In my app, there is a grid that you can drill down. You can go back to prev view via some links but the back bowser button is not integrated to that, so that if you do hit the back browser button, it logs out of the app which I don't want. I would be happy if it would redirect to the first page. I think this part is what we need. [URL] this is the startpage.xaml, at the end there is the hyperlink - so maybe here I can see if the back browser is pressed ( there is no other place in the codes that would navigate out), and if this is pressed I can redirect to a different spot? Is this a sound idea and how do I check if this back browser has been pressed?
I'm using 2 masterpages in my project.One master page is for login page and another one for the HomePage where user will go thro the options to reach other pages from home page..The thing is,i have "Logout" button in my home page.When i click on the logout button,the page will be redirected to "LoginPage.aspx". After redirecting to login page,when i click on browser back button,the previous page is displaying but it should not display to user since i'm doing sensitive transactions in all pages...
i just like to ask if you have any idea of preventing the Back button of the browser to navigate back to the previous page after a user log in.Ex:After a user successfully logged in to my website and he/she hit the Back button of the browser.I want this to not redirected to the previous page instead redirected to the same page which is my Main page.Also after a user logged out to my website and again he/she hit the Back button of the browser.I also want this to not redirected to the previous page instead redirected to my login page.
Not sure if i'm posting in the right forum, if not, please move it...i have the following issue... I want to "disable" browser's back button. Seems it's not possible, but using cache.setcacheability and timing it, kinda disables the option of navigating back. I need this because in some pages of my webpage, i keep values in a Session variable so when a page loads, i need to check that variable, and, if navigating back, cant do that. I also "set cache to false" because if someone closes session, and i allow cache, someone else could handtype a url in that same pc and see the page without login (though if he/she tries to navigate through it will be kicked out because when loading a new page, i'll know that he/she is not logged) but i dont want to allow even that,
that's why cache is disabled. The problem is that loading over and over again my masterpage (header, footer, menu and stuff) is going to slow down the webpage, because every time there's a request, the page has to be sent again completely. So, is there something like a "mix" mode where i can allow cache just for a few things? If not, what's the best practice to achieve both things i'm trying: speed and security?
After user has logged out i am redirecting user to home.aspx and from here i do not want user to be able to go back using browser back button.. How can i do it? I used this code in javascript :
