asp.net web application security issue

Question

0.00/5 (No votes)

See more:

i have 4 pages asp.net web application
first page is logg in page.. where the user logg in
and then redirected to 1.aspx,

but when user click the back button on browser, application redirectd to logg in page
and after this , when user click the forward button on browser it redirects again to 1.aspx without
asking ID , password.

and also if user knows the link of the page i:e 1.aspx
he can also access this page without giving ID, password
by jst typing the URL of page in browser..

how can i prevent my app, from this??

like when user logged inn and clik back his session get expire
and he has to give ID and password again to access 1.aspx

and nobody can access the page by simply giving the URL of page

need help! (i am beginner)

Posted 2-May-12 12:34pm

syed armaan hussain

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Dev-0001 · Answer 1 · 2012-05-02T19:38:00

Solution 2

You can disable back button check this link How to disable browser's back button[^]

Posted 2-May-12 19:38pm

Dev-0001

Comments

syed armaan hussain 3-May-12 17:19pm

thnks ur sharing is really worthy !
but it is not what i want .

syed armaan hussain 4-May-12 14:25pm

i placed this code at my page_load event, but it is not working

Response.Buffer = true;
Response.ExpiresAbsolute = DateTime.Now.AddDays(-1d);
Response.Expires = -1500;
Response.CacheControl = "no-cache";

**R. Giskard Reventlov** · Answer 2 · 2012-05-02T12:40:00

The simplest way is to have a method on the load event of each page which checks to see what the status of the user is. Once they've logged in, you could set a variable to indicate that the user is valid. Store this in the Session and then check it as and when. If the user doesn't pass the test then redirect back to the login page. Plainly, that is a very simplistic overview but should set you in the right direction. There are a lot of ways to do this so you just need to find the method that is appropriate to your requirements. Try searching here and Google for articles that will explain this in more depth - I believe there a couple of really good articles here on web security if you take some time to look.