This is such a common problem.
The problem is, when you click the Back button, your browser gets the page
from its cache. Worse than that, it means that no page_load event is
generated.
The choices you have are pretty limited (AFAIK). You can either try to
disable the Back button, by clearing the browser cache or something, or you
can deal with the problem when it genuinely arises. The former is really
annoying to users.
If you think about it, the problem is not that the page displays, but that
the user then moves on from that page and expects that data to be as
displayed in the browser. Because the session has been cleared, this will
not be the case. What you need to do, therefore, is to check the state of
the application when the user clicks on whatever action control you have
that deals with the application's state - usually a submit or "next" button.
You should be able to check the application's consistency at this point and,
if the application data is not consistent (i.e. you detect, implicitly, that
the user used the browser back button or the session timed out or whatever)
you can display a message or throw an exception or redirect to the login
page or do whatever is reasonable in your program.
This works for us. We make it easier for ourselves by maintaining
application-specific objects that hold the application state. All we put in
the Session are references to these objects. Storing tonnes of data in an
unstructured way in the Session is a really bad idea IMHO. We also use
forms authentication and attributes to ensure that users who are not logged
in and/or do not have the required role(s) cannot access classes and/or
methods innappropriately. We usually decorate every Page class, and every
method that alters the application state. In the case you mention, we would
have used FormsAuthentication.SignOut() and Session.Abandon(): therefore the
user would fail the security challenge on the Submit or Next button event
handler, because the event handler would be decorated with the appropriate
attributes.
HTH
Peter