How to Expire a Webpage (VB.Net)

[Josh Andrews]

Hi all, I'm studying creating webpages in VB.Net. After a successful Logon, I want that page to expire or simple disallow users to 'go back' to that page (not necessarily disable the back button). I have created webpages under the Master Page.

Thanks in advance,
Josh

[yarbrough40]

What method of "Log In" are you using?
What Logoff method(s) have you attempted so far?

[Josh Andrews]

Hi yarbrough40,
Login Method? Do you mean how do I connect to my database? I have an SQL db where the user profiles are stored. I use sql connection string (and sql data adapter) to check if users exist.

Log-off Method. I simply redirect them to my login page. My problem is that previous pages can still be navigated through even when the users are supposedly logged off the system :-(

I am a newbie in web development, so any help would be appreciated :-)

[Josh Andrews]

yarbrough40 I also have this procedure:

[CODE]
Protected Sub imgLogOff_Click (ByVal sender As Object, ByVal e As System.Web.UI.I mageClickEventA rgs) Handles imgLogOff.Click

Session.Clear()
Session.Abandon ()

End Sub

[\CODE]

[Paul Johnson]

I think yarbough40 means how are you getting the user to logon rather than how you check the SQL ;)

For not needing to return, you could just see if a session variable has been set on the login page. If it's set, return to the page you've just come from. You need to put it in the Page_Load routine (from memory - it's been a while since I've done this)

Session.Abandon () destroys the session and causes Session_OnEnd to be triggered

Session.Clear() clears the session object, but the session with the same key is still alive. In otherwords, if you want the user to not need to relogin, you use this.

In this case, Session.Clear() is not needed

[Josh Andrews]

Hi Paul, I tried using Session.Abandon () but still users can navigate through the pages.

[Paul Johnson]

Quite possibly they have a copy in their cache...

I would set a cookie which is deleted on Session.Abandon (). If it's there they can look around. If it's not they get redirected to the login (you may have to include it on the Page_Load routine for each page though - just call a common method)