Prevent back button

Question

I am using Razor on ASP.NET MVC with C#.

I am calling an external web page to process a credit card and it returns to me. I then display a receipt.

I'd like to prevent them from going back to the previous screen.

I do not have an underlying cs page, like asp since these are .cshtml files, to grab the event.

This receipt page is a View so I cannot put JavaScript in the header since it would affect every page using it.

Anyone know how I prevent the back button in this circumstance?

Answer 1

One possibility is to exclude the page you don't want to get back to from caching on the client. This could be done by setting the proper response headers. Here's an example with a [NoCache] custom action filter which you could use to decorate the corresponding controller action.

Answer 2

Firstly, if the previous page posted data to the server, best to Redirect(...) to another action after the successful processing, to avoid the data being resubmitted on "Refresh".

Then also set the page to expire, so the back button doesn't work:

https://stackoverflow.com/a/5352953/864763

Answer 3

You're asking the wrong question. Don't try to disable "back" on the client. This will be doomed to fail; you may be able to make it harder, but you'll never win that fight. Instead you should re-write the particular page that you have such that it will only ever process the credit card once. You should (on the server) "remember" that you've processed the credit card so that if the user goes back to the page to resubmit it you can just give them an error message saying "you have already submitted this information, you cannot submit this request twice".

Now, there are several ways of accomplishing this general goal, and some are better than others, but that's the goal you need to strive towards.

One way to do this is to go to every page that will redirect the user to this credit card form; just before submitting the request add something to that user's session (i.e. "pendingCreditCardSubmission" = true) Once they submit that request you then check for that session variable. If it's true, submit the request and set it to false, if it's false or not there then send an error message to the user.