Prevent Use of the Back Button (in IE)

Question

So the SMEs at my current place of employment want to try and disable the back button for certain pages. We have a page where the user makes some selections and submits the

Answer 1

I don't see this solution :

function removeBack(){
	window.location.hash="nbb";
	window.location.hash="";
	window.onhashchange=function(){window.location.hash="";}
}

Answer 2

You should secure your application against double submission instead of breaking user interface to hide the bug.

Answer 3

I've seen this before:

window.onBack = history.forward();

It is most definitely a dirty hack and, if at all possible, I would attempt to not disable the back button. And the user can probably still get around it quite easily. And depending on caching, there is no telling if the server code will be processed or if the cached page with JavaScript will run first.

So, yeah, use at your own risk :)

Answer 4

Because of the security isolation of javascript in the browser, you cannot change what the back button does.

Perhaps you could store something in the user's session that indicates that a comment is needed, and have any page in the app that the user tries to load redirect to the comment page?

What if the user closes their browser when he/she gets tot he comment page?

I know that you have not been given a choice here, but since what they are asking for seems to be impossible...

Perhaps you could just not consider the item as completed until the user enters comments. Thus, you would need to keep track of both in-progress items and completed items, and make that distinction in the UI, but this might be the most robust method.

Or just put the comment field on the form page?

Answer 5

Don't do this, just don't. It's bad interface design and forces the user's browser to behave in a way that they don't expect.

I would regard any script that successfully stopped my back button from working to be a hack, and I would expect the IE team to release a security-fix for it.

The back button is part of their program interface, not your website.

In your specific case I think the best bet is to add an unload event to the page that warns the user if they haven't completed the form. The back button would be unaffected and the user would be warned of their action.

Answer 6

If you are starting a new web app from scratch, or you have enough time to rework your app, you can use JavaScript and AJAX to avoid the browser's history, back, and forward functions.

• Open your app in a new window, either before or immediately after login.
• If you wish, use window options to hide the nav bar (with the back and forward buttons).
• Use AJAX for all server requests, without ever changing the window's location URL.
• Use a simple web API to get data and perform actions, and render the app using JavaScript.
• There will be only one URL in the window's history.
• The back and forward buttons will do nothing.
• The window can be closed automatically on logging out.
• No information is leaked to the browser history, which can help with security.

This technique answers the question, but it also contradicts best practice in several ways:

• The back and forward buttons should behave as expected.
• An app should not open new browser windows.
• An app should still function without JavaScript.

Please carefully consider your requirements and your users before using this technique.