title: Logout issue with browser back button
body: <p>I have created Login/ Logout functionality using ASP.Net MVC 4. I used my own created form for authenticate users against Active Directory. It is working fine with the functionality.</p>
  
  <p>Still there is a big issue in security. Once user click on the logout link he/ she successfully logged out and redirected to login form again. Code  in the controller looks like below.</p>
  
  <pre><code>    public ActionResult Logout()
      {
          // Tried to include below 3 lines in _Layout.cshtml as well. But not identifying.
          Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(-1));
          Response.Cache.SetCacheability(System.Web.HttpCacheability.NoCache);
          Response.Cache.SetNoStore();            
  
          Session.Abandon();              
  
          return RedirectToAction("Login");
      }
  </code></pre>
  
  <p>BUT, once Browser back button clicked, the user can go back to the other pages and navigate thru pages. </p>
  
  <p>I went thru several solutions, different approaches but none worked out. Seems the MVC approach is very different from ASP.NET forms. Appreciate your help on this.</p>
  
  <p>(I'm looking to solve this using C#/ MVC way. Not using JavaScript to disable/ close the browser on logout.)</p>
  
  <p><strong>UPDATE:</strong> Code fragments</p>
  
  <pre><code>    [HttpPost]
      public ActionResult Login(LoginModel authUser)
      {
          // Call Helper to get LDAP info. Will return username with groups or null      
          UserModel userProfile = LdapLoginHelper.AuthenticateUser(authUser);
  
          if (userProfile != null)
          {                
              Session["UserName"] = userProfile.UserName;
              Session["LdapGroups"] = userProfile.LdapGroups;
  
              if (userProfile.LdapGroups.Contains("Administrators"))
              {
                  // To be implemented                   
              }
              else
              {
                  // To be implemented      
              }
  
              // Successful login. Redirect to main page
              return RedirectToAction("Home", "Home");
          }
          else
          {
              // Invalid Login. Redirect to Login page
              return RedirectToAction("Login");
          }            
      }
  
  
  
      public ActionResult Logout()
      {
          // Not worked
          Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(-1));
          Response.Cache.SetCacheability(System.Web.HttpCacheability.NoCache);
          Response.Cache.SetNoStore();
          Session.Abandon();
  
          /// Tried this too. Not worked.
          /// Session.Clear();
          /// FormsAuthentication.SignOut();
  
          //// Tried this also. Not worked.
          //// WebSecurity.Logout();
  
          return RedirectToAction("Login");
      }
  </code></pre>
  
  <p>In addition to this common _Layout.cshtml page header looks like below.</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html lang="en"&gt;
  &lt;head&gt;
  &lt;meta charset="utf-8" /&gt;
  &lt;meta http-equiv="Pragma" content="no-cache"&gt;
  &lt;meta http-equiv="Expires" content="-1"&gt;
  &lt;meta http-equiv="CACHE-CONTROL" content="NO-CACHE"&gt;
  .
  . 
  .
  </code></pre>