How to disable cache in asp.net?

Question

I'm working on e-commerce website using VB.NET. User login to buy some of products and they can see order details. Once they logged in, session for user Id is created and logged out, all sesssion is abandoned.

I logged in the site, copy one of the link(e.g. order details) and logged out. When I run the link, the page is stil displayed eventhoug session is abandoned.

If I refresh the page, the page back to login page.

This haapends some of browser. I have tested IE, even same version of IE 8, some of them cashed the page, the o.

How can I disable cached page?

See forums.asp.net/t/1268449.aspx/1

Bala R
– Bala R

2011-10-05 14:10:50 +00:00
Commented Oct 5, 2011 at 14:10 — Bala R
– Bala R, Commented Oct 5, 2011 at 14:10

Matt Cofer · Accepted Answer · 2011-10-05 15:14:25Z

2

In addition to ending the session upon logout are you also telling the .NET Authentication to end? When using forms authentication, for example, you need to FormsAuthentication.SignOut();

answered Oct 5, 2011 at 15:14

Matt Cofer

2,9921 gold badge20 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Matt Cofer Over a year ago

Meaning, I don't think caching is your problem. I think the issue is that the user's session has ended but their authentication token still exists so they are allowed in to the page. Once the page tries to refresh and use a session object then it finds no session so it redirects to the login page.

Joel Coehoorn · Accepted Answer · 2011-10-05 14:10:15Z

0

It sounds like the page might be cached by the browser. Refreshing the page tells the browser that you don't want to see the cached version in a way that just revisiting an old page does not.

I'm hesitant to suggest a complete solution here, as it sounds like this may be a security issue for you. There are some things you can to tell the brower you would prefer it not cache the page, but browsers can be easily made to ignore this kind of instruction.

answered Oct 5, 2011 at 14:10

Joel Coehoorn

418k114 gold badges582 silver badges820 bronze badges

1 Comment

jeeunit02 Over a year ago

Thanks, even I updated code that disabled cashe, it still does not work. I think browser just ignore this. It is same version of IE 8 and react differently.

James Johnson · Accepted Answer · 2011-10-05 15:08:26Z

0

Try something like this:

Response.Cache.SetCacheability(HttpCacheability.NoCache); 
Response.Cache.SetNoStore();

I think you can do it this way too:

<meta http-equiv="Expires" CONTENT="0"> 
<meta http-equiv="Cache-Control" CONTENT="no-cache"> 
<meta http-equiv="Pragma" CONTENT="no-cache">

EDIT

After reading more into your question, I think you need to add some logic either in a base page or master page to validate that the user is authenticated, and redirect the user to the login page they're not.

edited Oct 5, 2011 at 15:08

answered Oct 5, 2011 at 14:10

James Johnson

46.1k8 gold badges75 silver badges111 bronze badges

Collectives™ on Stack Overflow

How to disable cache in asp.net?

3 Answers 3

1 Comment

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related