Warning message in ASP page during back using browser's back button

[Dipti Singh]

Hi All,
Please help me, I am trying it from 2 days.
I have a login page in asp that is including other pages using #include.....
after login user in the same page but enters in the database.
I want to disable to call this page using back button after logout. I have used this method:

<%Response.Expi res = -1 %>
<%Response.Expi resAbsolute = Now() - 1 %>
<%Response.AddH eader "pragma", "no-cache" %>
<%Response.AddH eader "cache-control", "private" %>
<%Response.Cach eControl = "no-cache" %>
----------------------------------------------------------------------------------------
but for other pages this is working fine but for login page it is not because it is the result of post values.

Please tell me how can i disable the browser to resubmit the information again, because it give a warning message and upon refershing it resumit the information and that page is ready to use to user after log out.

Thanks

[jhardman]

Please tell me how can i disable the browser to resubmit the information again, because it give a warning message and upon refershing it resumit the information and that page is ready to use to user after log out.

Thanks

Ok, this work-around is a little awkward, but it does work. Do you set a user ID in a session-level variable after login?

session("userID") = request("login")

on the login page, or on the page that handles the login, add a simple line like this right at the top:

if session("userID") <> "" then
   response.redirect "anotherPage.asp"
end if

Let me know if this helps.

Jared

[Dipti Singh]

Thanks for ue suggestion, but i have already tried this way.it does not work.

understand my problem:

I have a page workhere.asp, that is including another page login.asp, in login.asp, user is entering uid and pwd n posting the values to workhere.asp.
which again calliung login.asp n there is if else condition in login.asp. if user enters write uid n pwd then user gets into database but the page is workhere.asp itself.
thats y i was saying it is the result of post values.
when i click on back button after logout, browser asks to refresh the page n if i refresh the page it sends the uid n pwd to workhere.asp, becoz login.asp has posted those values.

i readout some where that this type of condiotion can not be prevented.but still there must be some solution.
one solution is there to seprate the files.

but i don't want to modify more files.becoz this is a live project.

Regards

[jhardman]

Thanks for ue suggestion, but i have already tried this way.it does not work.

understand my problem:

I have a page workhere.asp, that is including another page login.asp, in login.asp, user is entering uid and pwd n posting the values to workhere.asp.
which again calliung login.asp n there is if else condition in login.asp. if user enters write uid n pwd then user gets into database but the page is workhere.asp itself.
thats y i was saying it is the result of post values.
when i click on back button after logout, browser asks to refresh the page n if i refresh the page it sends the uid n pwd to workhere.asp, becoz login.asp has posted those values.

i readout some where that this type of condiotion can not be prevented.but still there must be some solution.
one solution is there to seprate the files.

but i don't want to modify more files.becoz this is a live project.

Regards

it doesn't matter if the "back" button posts values again as long as you check for session variables on the log in page before handling the posted form data. I'm serious. You can make the page completely ignore any data posted to it by handling the session variables first, and if they exist, ignore the posted data. This is why you don't re-log in to hotmail, for example, if you hit the "back" button. Do you currently use session-level variables?

Some people like to use a "logout" button. These are becoming fairly standard, so much so that many users will realize they are expected to use them when done with your site, even without prompting. But still, a determined user could push "back" enough times to log in again, unless you check for session variables.

Jared