After session invalidation should not be able to view secure pages by

[roopan27]

Hi,
In my application, on clicking logoff button I have used
session.invalidate. But if I click the back button of the browser first it tells me that the page has expired and to click refresh. when I hit refresh, it gives dialog box that page requires resending of information retry or cancel,If I press retry it shows me the secure page.This shold not happen.Once I logoff if I click the back button it should not go back at all. how can I do this?

 

[venur]

Hi,

You have to user JavaScript so that user cannot go back to the previous page once he clicks logoff.

Cheers,
Venu

 

[roopan27]

Could you give me what code would be needed or point me to it? It would be a great help.

 

[venur]

Hi,

Have look at this link...

http://www.experts-exchange.com/Web/Web_Languages/JavaScript/Q_20682401.html

Cheers
Venu

 

[sedj]

You cannot actually disable the back button unless your web page is a modal dialog, which is probably not what you want.

All you can do (via JavaScript) is do a history.forward() call to make the "back" pacge just dsplay the current, or other "forward" page. If you are unsure of how to do this, ask in the JavaScript forum.

 

[RiazKhanmohamed]

Don't know if this would help, but i've got a similar system, although it's not as high level secure. What i do is on login store the loginid in a session variable. then on every page within the system, it checks if there is one, and if not returns to the login page. it's tedious but works. i also have frames, so i put this code on them, so if people bookmark my site it still returns them to the login screen.

i just used an if statement to check and then redirected the user to the login.

hope this helps