<p>I have some website which requires a logon and shows sensitive information.</p>

<p>The person goes to the page, is prompted to log in, then gets to see the information.</p>

<p>The person logs out of the site, and is redirected back to the login page.</p>

<p>The person then can hit "back" and go right back to the page where the sensitive information is contained. Since the browser just thinks of it as rendered HTML, it shows it to them no problem.</p>

<p>Is there a way to prevent that information from being displayed when the person hits the "back" button from the logged out screen? I'm not trying to disable the back button itself, I'm just trying to keep the sensitive information from being displayed again because the person is not logged into the site anymore.</p>

<p>For the sake of argument, the above site/scenario is in ASP.NET with Forms Authentication (so when the user goes to the first page, which is the page they want, they're redirected to the logon page - in case that makes a difference).</p>

[{'answer_id': 64079, 'author': 'Espo', 'author_id': 2257, 'author_profile': 'https://Stackoverflow.com/users/2257', 'pm_score': 2, 'selected': False, 'text': '<p>From <a href="http://www.aspdev.org/asp.net/asp.net-disable-caching/" rel="nofollow noreferrer">aspdev.org</a>:</p>\n\n<p>Add the following line on top of the Page_Load event handler and your ASP.NET page will not be cached in the users browsers: </p>\n\n<pre><code>Response.Cache.SetCacheability(HttpCacheability.NoCache)\n</code></pre>\n\n<p>Settings this property ensures that if the user hits the back-button the content will be gone, and if he presses "refresh" he will be redirected to the login-page.</p>\n'}, {'answer_id': 64081, 'author': 'TheSmurf', 'author_id': 1975282, 'author_profile': 'https://Stackoverflow.com/users/1975282', 'pm_score': 0, 'selected': False, 'text': '<p>You are looking for a no-cache directive:</p>\n\n<pre><code>&lt;META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"&gt;\n</code></pre>\n\n<p>If you\'ve got a master page design going, this may be a little bit of a juggle, but I believe you can put this directive on a single page, without affecting the rest of your site (assuming that\'s what you want).</p>\n\n<p>If you\'ve got this directive set, the browser will dutifully head back to the server looking for a brand new copy of the page, which will cause your server to see that the user is not authenticated and bump him to the login page.</p>\n'}, {'answer_id': 64086, 'author': 'Jason Cohen', 'author_id': 4926, 'author_profile': 'https://Stackoverflow.com/users/4926', 'pm_score': 0, 'selected': False, 'text': '<p>Have the logout operation be a <code>POST</code>.  Then the browser will prompt for "Are you sure you want to re-post the form?" rather than show the page.</p>\n'}, {'answer_id': 64091, 'author': 'UnkwnTech', 'author_id': 115, 'author_profile': 'https://Stackoverflow.com/users/115', 'pm_score': 0, 'selected': False, 'text': '<p>I don\'t know how to do it in ASP.NET but in PHP I would do something like:</p>\n\n<pre><code>header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");\nheader("Cache-Control: no-cache");\nheader("Pragma: no-cache");\n</code></pre>\n\n<p>Which forces the browser to recheck that the item, so your authentication checking should be triggered, denying the user access.</p>\n'}, {'answer_id': 64093, 'author': 'Daniel Papasian', 'author_id': 7548, 'author_profile': 'https://Stackoverflow.com/users/7548', 'pm_score': 0, 'selected': False, 'text': '<p>The correct answer involves use of setting the HTTP Cache-Control header on the response.  If you want to ensure that they <b>never</b> cache the output, you can do Cache-Control: no-cache.  This is often used in coordination with no-store as well.</p>\n\n<p>Other options, if you want limited caching, include setting an expires time and must-revalidate, but these could potentially all cause a cached page to be displayed again.</p>\n\n<p>See <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.4" rel="nofollow noreferrer">http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.4</a></p>\n'}, {'answer_id': 64173, 'author': 'Henry B', 'author_id': 6414, 'author_profile': 'https://Stackoverflow.com/users/6414', 'pm_score': 0, 'selected': False, 'text': "<p>It's a bit of a strain, but if you had a java applet or a flash application that was embedded and authentication was done through that you could make it so that they had to authenticate in, erm, 'real-time' with the server everytime they wanted to view the information.</p>\n\n<p>Using this you could also encrypt any information.</p>\n\n<p>There's always the possibility that someone can just save the page with the sensitive information on, having no cache isn't going to get around this situation (but then a screenshot can always be taken of a flash or java application).</p>\n"}, {'answer_id': 64196, 'author': 'martin', 'author_id': 8421, 'author_profile': 'https://Stackoverflow.com/users/8421', 'pm_score': 0, 'selected': False, 'text': '<p>For completeness:</p>\n\n<pre><code>Response.Cache.SetCacheability(HttpCacheability.NoCache);\nResponse.Cache.SetNoStore();\nResponse.Cache.SetExpires(DateTime.Now.AddMinutes(-1));\n</code></pre>\n'}, {'answer_id': 64300, 'author': 'Jim', 'author_id': 8427, 'author_profile': 'https://Stackoverflow.com/users/8427', 'pm_score': 1, 'selected': False, 'text': '<p>DannySmurf, &lt;meta> elements are extremely unreliable when it comes to controlling caching, and Pragma in particular even more so.  <a href="http://www.mnot.net/cache_docs/#META" rel="nofollow noreferrer">Reference</a>.</p>\n'}, {'answer_id': 64322, 'author': 'Jim', 'author_id': 8427, 'author_profile': 'https://Stackoverflow.com/users/8427', 'pm_score': 1, 'selected': False, 'text': '<p>dannyp and others, no-cache does not stop caches from storing sensitive resources.  It merely means that a cache cannot serve a resource it has stored without revalidating it first.  If you wish to prevent sensitive resources from being cached, you need to use the no-store directive.</p>\n'}, {'answer_id': 65307, 'author': 'Ivan Bosnic', 'author_id': 3221, 'author_profile': 'https://Stackoverflow.com/users/3221', 'pm_score': 0, 'selected': False, 'text': '<p>Well, in a major brazilian bank corporation (Banco do Brasil) which is known by having one of the world´s most secure and efficient home banking software, they simply put history.go(1) in every page.So, if you hit the back button, you will be returned. Simple.</p>\n'}, {'answer_id': 88467, 'author': 'Claus Thomsen', 'author_id': 15555, 'author_profile': 'https://Stackoverflow.com/users/15555', 'pm_score': 5, 'selected': True, 'text': '<p>The short answer is that it cannot be done securely.</p>\n\n<p>There are, however, a lot of tricks that can be implemented to make it difficult for users to hit back and get sensitive data displayed.</p>\n\n<pre><code>Response.Cache.SetCacheability(HttpCacheability.NoCache);\nResponse.Cache.SetExpires(Now.AddSeconds(-1));\nResponse.Cache.SetNoStore();\nResponse.AppendHeader("Pragma", "no-cache");\n</code></pre>\n\n<p>This will disable caching on client side, however this is <strong>not supported by all browsers</strong>.</p>\n\n<p>If you have the option of using AJAX then sensitive data can be retrieved using a updatepanel that is updated from client code and therefore it will not be displayed when hitting back unless client is still logged in.</p>\n'}, {'answer_id': 107330, 'author': 'Andy Lester', 'author_id': 8454, 'author_profile': 'https://Stackoverflow.com/users/8454', 'pm_score': 0, 'selected': False, 'text': '<p>Please look into the HTTP response headers.  Most of the ASP code that people are posting looks to be setting those.  Be sure.</p>\n\n<p>The <a href="http://oreilly.com/catalog/9781565925090/" rel="nofollow noreferrer">chipmunk book from O\'Reilly</a> is the bible of HTTP, and <a href="http://www.informit.com/store/product.aspx?isbn=0672324547" rel="nofollow noreferrer">Chris Shiflett\'s HTTP book</a> is good as well.</p>\n'}, {'answer_id': 217117, 'author': 'Kornel', 'author_id': 27009, 'author_profile': 'https://Stackoverflow.com/users/27009', 'pm_score': 3, 'selected': False, 'text': '<p><a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.13" rel="noreferrer">Cache and history are independent</a> and one shouldn\'t affect each other.</p>\n\n<p>The only exception <a href="http://my.opera.com/yngve/blog/2007/02/27/introducing-cache-contexts-or-why-the" rel="noreferrer">made for banks</a> is that combination of HTTPS and <code>Cache-Control: must-revalidate</code> forces refresh when navigating in history.</p>\n\n<p>In plain HTTP there\'s no way to do this except by exploiting browser bugs.</p>\n\n<p>You could hack around it using Javascript that checks <code>document.cookie</code> and redirects when a "killer" cookie is set, but I imagine this could go seriously wrong when browser doesn\'t set/clear cookies exactly as expected.</p>\n'}, {'answer_id': 417162, 'author': 'Ed Griebel', 'author_id': 3889, 'author_profile': 'https://Stackoverflow.com/users/3889', 'pm_score': 0, 'selected': False, 'text': '<p>You can have the web page with the sensitive be returned as an HTTP POST, then in most cases browsers will give you the message asking if you want want to resubmit the data. (Unfortunately I cannot find a canonical source for this behavior.)</p>\n'}, {'answer_id': 767611, 'author': 'User', 'author_id': 62830, 'author_profile': 'https://Stackoverflow.com/users/62830', 'pm_score': 0, 'selected': False, 'text': '<p>I just had the banking example in mind.</p>\n\n<p>The page of my bank has this in it:</p>\n\n<pre><code>&lt;meta http-equiv="expires" content="0" /&gt;\n</code></pre>\n\n<p>This should be about this I suppose.</p>\n'}, {'answer_id': 768884, 'author': 'Jason Coyne', 'author_id': 56472, 'author_profile': 'https://Stackoverflow.com/users/56472', 'pm_score': 1, 'selected': False, 'text': '<p>You could have a javascript function does a quick server check (ajax) and if the user is not logged in, erases the current page and replaces it with a message.  This would obviously be vulnerable to  a user whos javascript is off, but that is pretty rare. On the upside, this is both browser and server technology (asp/php etc) agnostic.</p>\n'}]
['https://Stackoverflow.com/questions/64059', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/2577/']