I have the following problem:

I've developped an ASP application to process Electronic Fund Transfers. 
After the user has agreed on the amount to transfer and clicks on a 
process button, a confirmation page comes along. If the user clicks on the 
process button on the confirmation page, the EFT transaction is processed 
and a page with the transaction number is displayed. If the user presses 
the back button (or back space, or rigjt clicks on the mouse and clicks 
back), the browser goes back to the confirmation page and if the user 
clicks process, the EFT transaction is resubmited.

I need to know if there is a way to prevent the browser from dysplaying a 
page by clocking on the back button. Can a expiration be set on a page?

I would strongly suggest you read the HTTP specification on expiry and
caching directives, especially if this is going to be used for a banking
application!

Section 13: http://www.ics.uci.edu/pub/ietf/http/rfc2068.txt

Something like this may help:

Set SetHTTPHeaders( _
    )

    Response.ExpiresAbsolute = #1/1/1980#
    Response.AddHeader "cache-control", "no-cache, private, must-revalidate"
    Response.AddHeader "pragma", "no-cache"

    ' Add an e-tag header here as well
    ' You'll need some way to calculate a unique ETag value
    ' (eg by URLEncoding() the current date/time)

End Sub

Cheers
Ken


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From: "Juan Rosado" <jrosado@n...>
Subject: [asp_web_howto] Set expiration on page.


: I have the following problem:
:
: I've developped an ASP application to process Electronic Fund Transfers.
: After the user has agreed on the amount to transfer and clicks on a
: process button, a confirmation page comes along. If the user clicks on the
: process button on the confirmation page, the EFT transaction is processed
: and a page with the transaction number is displayed. If the user presses
: the back button (or back space, or rigjt clicks on the mouse and clicks
: back), the browser goes back to the confirmation page and if the user
: clicks process, the EFT transaction is resubmited.
:
: I need to know if there is a way to prevent the browser from dysplaying a
: page by clocking on the back button. Can a expiration be set on a page?
: