Problem with my Session variables in asp.net 2.0

Question

I keep a Session variable when the user is logged in. So that when the user click on btnLogout it must clear all my sessions and Log the User out for GOOD!!!

It does clear my sessions but if i click the BACK button in IE right after i logged out then i am still logged in! Meaning it goes back to screen where the user was still logged into.

My code on log out

protected void btnLogout_Click
{
   Session.Clear();
   Session.Abandon();
   Session.RemoveAll();

   Response.Redirect("Home.aspx");
}

Why is this and how can i prevent this?

EDIT: Is there maybe an option in code i can do that will disable the user from pressing the BACK button in the Web Browzer?

Answer 1

You could put this in the Page_Init of your Master:

Response.Cache.SetNoServerCaching();
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetNoStore();
Response.Cache.SetExpires(new DateTime(1900, 01, 01, 00, 00, 00, 00));

This is, e.g., what most bank websites do so you can't effectively use the back button.