Re: Forms Authentication and cached pages

I found the exact same answer on this article, Preventing Review of Secured Pages, and I'm about to give it a try. I thought this was the default behavior, naïve of me...
http://aspalliance.com/694


-----Original Message-----
From: Discussion of building .NET applications targeted for the Web [mailto:[email protected]] On Behalf Of Efran Cobisi
Sent: Wednesday, March 21, 2007 11:11 AM
To: [email protected]
Subject: Re: [DOTNET-WEB] Forms Authentication and cached pages

Hello Lizet,

Afaik, setting the cache control of your http response to no-store would
do the trick. You could use the following line of code [C#] before
issuing the last redirect:

Context.Response.Cache.SetNoStore();

HTH,

Efran Cobisi
http://www.cobisi.com

Lizet Pena de Sola wrote:
> Hi all,
> I'm reviewing a web project that uses Forms authentication.
> After the authentication process we create an encrypted ticket, create
> the cookie that will be used by the FormsAuthentication provider and
> redirect to the requested page:
> Dim isCookiePersistent As Boolean = False
> Dim authTicket As New FormsAuthenticationTicket(1, UserName,
> DateTime.Now, DateTime.Now.AddMinutes(60), isCookiePersistent, UserData)
>
>             Dim encryptedTicket As String =
> FormsAuthentication.Encrypt(authTicket)
>
>             Dim authCookie As New
> HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
>
>             If (isCookiePersistent) Then
>                 authCookie.Expires = authTicket.Expiration
>             End If
>
>
>             Context.Response.Cookies.Add(authCookie)
>             FormsAuthentication.RedirectFromLoginPage(UserName, False)
>
>
>
> During user log out we clear the session, call the
> FormsAuthentication.SignOut() and redirect the user to the login page.
>
> We have, however, an odd behavior. After the user has logged out of the
> application, he can, by clicking the back button on the same browser
> windows, navigate to the previous pages he opened. These pages are in
> the secure area. These pages are not requested to the server, these
> requests do not hit the server so I presume the user sees cached pages
> in the client.
>
> Any suggestion on how to avoid this is more than welcome,
>
>
>
> Lizet
>
> ===================================
> This list is hosted by DevelopMentor®  http://www.develop.com
>
> View archives and manage your subscription(s) at http://discuss.develop.com
>

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com