Clearing Session Variables

[JJ_377]

In a "Save and Quit" button on my web app form (aspx), I have the
following code that is supposed to clear a session variable (an user
id) and redirect to a logon page:

Session.Clear()
Session.Abandon()
Response.Redirect("ApplicantLogon.aspx")

1. The redirect occurs, but the session variable does not clear.

2. A related issue that ****worries me greatly**** is that once
redirected to the logon page, selecting the browser's back button,
redirects to the web form on which the user has entered data!

This latter page has code in the onload event that looks for the
session variable assignment, and if it doesn't find it, it is supposed
to redirect the user to the logon page...however, since I didn't suceed
in clearing the variable using the session methods, above, this does
not work...

Can someone educate me?

Thank you.
J.

 

[Guest]

JJ_377,

Regarding ISSUE #2 : When user clicks browser back button, the browser
loads the page and user entered data from local cache. One way to prevent
this is by expiring the local cache as in following sample.

private void Page_Load(object sender, System.EventArgs e)
{
ExpirePageCache();
.............................................
.........
}

/// <summary>
/// This function prevent the page being retrieved from broswer cache
/// </summary>
private void ExpirePageCache()
{
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetExpires(DateTime.Now-new TimeSpan(1,0,0));
Response.Cache.SetLastModified(DateTime.Now);
Response.Cache.SetAllowResponseInBrowserHistory(false);
}

Sreejith

 

[Joe Fallon]

I use code like this:

 

[Joe Fallon]

I use code like this:

HttpContext.Current.Session.Clear()
System.Web.Security.FormsAuthentication.SignOut()
HttpContext.Current.User = Nothing
Response.Redirect("~/Login.aspx", True)

 

[JJ_377]

Exactly. Thank you. I stumbled onto this, recalling from my previous
life as an asp programmer...except, I am using a page directive to set
cache to none. I am using vb.net, and therefore can set this
programmatically in page load. Don't know that there is any difference
between setting cache as a page directive or programmatically in page
load?

 

[JJ_377]

Thank you - that is very specific and I am not familiar with lines 2
and 3, but I will investigate.

 

[JJ_377]

Update: session variable does clear: because I'm not controlling cache
output, I didn't realize this...see following...