Re: Forms Authentication and cached pages

We had an interesting side effect though. We generate PDF reports and
excel reports on the fly. After setting up that http header directive,
the reports stopped to work. IE wouldn't recognize the file name and
gave error when the user tried to open or save the report...
interesting.

-----Original Message-----
From: Discussion of building .NET applications targeted for the Web
[mailto:[email protected]] On Behalf Of Pena, Lizet
(Consultant)
Sent: Wednesday, March 21, 2007 1:03 PM
To: [email protected]
Subject: Re: [DOTNET-WEB] Forms Authentication and cached pages

Hello Efran, 
We put this directive in the base class we use to inherit the pages
from, on the Init() event and the pages are no longer cached on the
client.
Thanks for the help, 
Lizet

-----Original Message-----
From: Discussion of building .NET applications targeted for the Web
[mailto:[email protected]] On Behalf Of Efran Cobisi
Sent: Wednesday, March 21, 2007 11:11 AM
To: [email protected]
Subject: Re: [DOTNET-WEB] Forms Authentication and cached pages

Hello Lizet,

Afaik, setting the cache control of your http response to no-store would
do the trick. You could use the following line of code [C#] before
issuing the last redirect:

Context.Response.Cache.SetNoStore();

HTH,

Efran Cobisi
http://www.cobisi.com

Lizet Pena de Sola wrote:
> Hi all,
> I'm reviewing a web project that uses Forms authentication.
> After the authentication process we create an encrypted ticket, create
> the cookie that will be used by the FormsAuthentication provider and
> redirect to the requested page:
> Dim isCookiePersistent As Boolean = False
> Dim authTicket As New FormsAuthenticationTicket(1, UserName,
> DateTime.Now, DateTime.Now.AddMinutes(60), isCookiePersistent,
UserData)
>
>             Dim encryptedTicket As String =
> FormsAuthentication.Encrypt(authTicket)
>
>             Dim authCookie As New
> HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
>
>             If (isCookiePersistent) Then
>                 authCookie.Expires = authTicket.Expiration
>             End If
>
>
>             Context.Response.Cookies.Add(authCookie)
>             FormsAuthentication.RedirectFromLoginPage(UserName, False)
>
>
>
> During user log out we clear the session, call the
> FormsAuthentication.SignOut() and redirect the user to the login page.
>
> We have, however, an odd behavior. After the user has logged out of
the
> application, he can, by clicking the back button on the same browser
> windows, navigate to the previous pages he opened. These pages are in
> the secure area. These pages are not requested to the server, these
> requests do not hit the server so I presume the user sees cached pages
> in the client.
>
> Any suggestion on how to avoid this is more than welcome,
>
>
>
> Lizet
>
> ===================================
> This list is hosted by DevelopMentor(r)  http://www.develop.com
>
> View archives and manage your subscription(s) at
http://discuss.develop.com
>

===================================
This list is hosted by DevelopMentor(r)  http://www.develop.com

View archives and manage your subscription(s) at
http://discuss.develop.com

===================================
This list is hosted by DevelopMentor(r)  http://www.develop.com

View archives and manage your subscription(s) at
http://discuss.develop.com

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com