Using the browser's back button after SignOut() allows access to secure page (ASP.NET MVC) -

-

I have an MVC app that uses [authorized] to protect private bits. I get a signal when I select the sign () URL, but if I press the back button on my browser then it goes to a secure page and even lets me use the form action And then it shows that I'm signed out. The problem is that it takes a safe operation (inserting the row into my database) then I can do it again using the back button. If I use the back button after logging out and refreshing the browser then it shows that I am logged out and refuse to allow me access to secure page

Is missing? It seems that this may actually be a big security problem. 

  Public Action Logoff (String Return Url) {FormsAuth.SignOut (); If (! String.IsNullOrEmpty (ReturnUrl)) {Return Redirect (ReturnUrl); } And {return redirect action ("index", "page"); I think the problem is that the browser caches the page.

This is the reason that when you do not reload the page after clicking on the back button. If you specify in the header that the page should not be cached, then it should reload the page by pressing the back button. And then the user has declined.

However, it may be difficult to work in some cases to achieve it. See it for more information.


Comments

Post a Comment

Popular posts from this blog

oracle - The fastest way to check if some records in a database table? -

-
I have a big table to work with. I have to see that there are some records whose parent_id is equal to my passing value. Currently I do this by implementing "my_table using select count (*) where parent_id =: id"; If the result> 0, it means that they exist. Because this is a very large table, and I do not care what the actual number of records present, I just want to know if it exists, so I think count (*) Bit is disabled. How do I apply this requirement most quickly? I'm using Oracle 10. # Tips for Hibernation & amp; Tricks It suggests writing in such a way: Integer number = (integer) session .createQuery ("Select Count (*) to ...."). UniqueResult (); I do not know what is the magic of the unique rule? Why does it fast? To compare, select "1 from mytable where parent_id = passId and rowrum", which is more efficient? If you are not interested in the number of records, then there is an EXISTS query one: Select 'y'
Read more

php - multilevel menu with multilevel array -

-
Just ask someone to solve this problem? I want to create a multilevel menu I can not find the right solution generated with multilevel array, it always gets an array_push error My study came from the original idea But still my Can not match the need. This is my MySQL [code] ----- --------------------- --------------- | ID | PARENT_ID | Name | Link | Seq | 1 | 0 | Dashboad | Dashboard / | 1 | 2 | 0 | Menu 1 | Menu 1 / | 2 | 3 | 0 | Menu 2 | Menu 2 / | 3 | 4 | 0 | Menu 3 | Menu 3 / | 4 | 5 | 2 | Joint Add / | 1 | 6 | 3 | Joint Add / | 1 | 7 | 2 | Edit | Edit / | 2 | 8 | 4 | Joint Add / | 1 ------------------------------------------ [/ Code] I want to do something like this in my array array ('dashboard' = & gt; array ('id' = & gt; '' 'Dame' = & gt; 'Dashboard', 'Title' = & gt; 'Dashboard', 'MatchMin' = & gt; Base_URL (). 'Dashboard /', 'Active' => = & Gt; NULL), &
Read more

jQuery UI: Datepicker month format -

-
I am trying to change the format of the month that shows in the popup (not in the date that the picker actually I do not have any choice anywhere to do this, do I like to use a sub-string () or something else? What I normally display is Trying to change: Class = "ui-datepicker-title"> January & lt; / span & gt; ... & lt; / div & gt; Div>
Read more