Logout issue with browser back button

Question

I have created Login/ Logout functionality using ASP.Net MVC 4. I used my own created form for authenticate users against Active Directory. It is working fine with the funct

Answer 1

I've only used SetExpires with DateTime.Now that would match you local server time to the cookie. Using DateTime.UtcNow.Addminutes(-1) could be the real culprit here.

Also, if your are using forms authentication, I don't see your call to

FormsAuthentication.SignOut();

Answer 2

Adding the following attribute to any ActionResult methods which return secure pages in your controller(s) should work:

public class MyControllerForAuthorizedStuff
{
    [OutputCache(NoStore = true, Duration = 0, Location = OutputCacheLocation.None)]
    public ActionResult Index()
    {
        return View();
    }
} 

Answer 3

add the following code in your global.asax page and remove first 3 lines from your logout() function.

protected void Application_BeginRequest()
{
    Response.Cache.SetCacheability(HttpCacheability.NoCache);
    Response.Cache.SetExpires(DateTime.UtcNow.AddHours(-1));
    Response.Cache.SetNoStore();
}