Regarding session expiration

Rohit Saxena · September 4th, 2009, 02:57 AM

Hello Imar.
I have read your book - Beginning ASP.NET 3.5 in C# and VB. I liked it very much and I got a large amount of knowledge on ASP.NET by reading this book. I have made a project on asp.net also.

However, I have one question which I know you can answer regarding session expiration in asp.net.
I want that a user login to my site and after login when he clicks on the back button of the browser, he will be redirected to the login page again and his session expires. How can I implement his in asp.net.
I hope you can answer me and if possible, please send me a small site which has this feature alongwith asp.net coding.

Thanking you

Reagrds

Rohit Saxena
INDIA
E-mail: [email protected]

Imar · September 4th, 2009, 04:34 AM

Hi there,

Good to hear you like the book.

I think you're mixing up two concepts here: Caching and Sessions. The problem you're describing is not related to sessions, but to caching. The previous page is cached by the browser so it's shown without another request to the server. To fix this, add the following line to the page you want to expire:

Code:

 
Response.Cache.SetCacheability(HttpCacheability.NoCache)

This tells the browser not to cache the page, and to request it from the server again instead.
You may have to clear your browser's cache the first time to make this work.

If it still doesn't work, try a combination of the following:

Code:

 
Response.Expires = -1500
Response.AddHeader("Pragma", "no-cache") 
Response.AddHeader("cache-control", "private")
Response.CacheControl = "no-cache"
Response.Cache.SetExpires(DateTime.Now.Date.AddDays(-100))
Response.Cache.SetNoServerCaching()
Response.ExpiresAbsolute = DateTime.Now.AddDays(-100)
Response.Cache.SetNoStore()
Response.Cache.SetCacheability(HttpCacheability.NoCache)
Response.Cache.SetValidUntilExpires(False)

You probably don't need them, but I've seen people report success with various combinations of these cache settings. YMMV.

Hope this helps,

Cheers,

Imar

jmiguy · November 16th, 2009, 11:46 AM

I've been banging my head against my desk for two days while trying to get this to work. After successful logout, I don't want users to be able to preview the expired page using the back button. Thanks for posting this code.. I will try it and post back with results.

Also, if I add this code to my master page, I'm assuming it will apply to any page tied to that master page. Is this correct?

Thanks,

Jeff

Imar · November 17th, 2009, 06:04 AM

Quote:

Also, if I add this code to my master page, I'm assuming it will apply to any page tied to that master page. Is this correct?

Yep, that's correct.

Imar

jmiguy · November 19th, 2009, 05:27 PM

Imar,

I added all of the code you provided and it seems to have done the trick. Thanks again.

Jeff