Logout Issue

[pupadu]

Hello everyone. I have an application (ASP and SQL Server) that requires a user to login and logout. When the user logs out, it takes them to the appropriate page. However, if they were to click the "Back" button on their browser, they still have access to the last page they had visited. Is there a way to keep the user from viewing the last page visited when they click the "Back" button?

Here is my logout code:

<%
Response.Buffer=True
Session.Abandon
Response.Clear
Response.Redirect "login.asp"
%>

Any and all suggestions and advice will be greatly appreciated.

 

[vbkris]

after the "Back" is clicked try refreshing the page, does the page work now?

if it does then there is an error in ur session checking. if it doesnt then its because of cache. try setting cache headers (this will disable back permanently even if the user is logged, u will get a "Page Expired" message)...

Known is handfull, Unknown is worldfull

 

[pupadu]

Thanks vbkris for the quick response. The page did continue to work.

I'm a bit of a novice with a growing knowledge of ASP. Could guide me in the right direction as to how I can find the error in my session checking?

Again, any and all suggestions and advice is greatly appreciated.

 

[Sheco]

I assume that you have some code at the top of all the protected pages .... code that keeps people out if they have not logged in... please post that code.

 

[pupadu]

Thanks to you as well, Sheco. Now I know that I'm a novice at ASP. I have a session check script at the top of the page the user is taken to after they have logged in. I don't have it on any other pages.

Based on this knowledge, I see where I'm truly going wrong with this. Like I've said before, a novice with a growing knowledge.

 

[Sheco]

I like to put that code into a little tiny file and then use the INCLUDE directive to pull it into all of the pages that I wish to protect. Just one little line like this:
<!--#include file="security.asp"-->

Check this link for more info:

http://www.w3schools.com/asp/asp_incfiles.asp

Except be aware that the first demo on that site uses a file with a .inc file extension. For security reasons you should only use files with a .asp extension because, that way, the server will never show the browser the contents of the file.