Disable the browser back button

Use this script to disable the browser back button once the user has logged out. So that even if he tries to click the back button and go back to the previous page he will not be able to go.

<script>

    history.pushState(null, null, location.href);

    window.onpopstate = function () {

        history.go(1);

    };

</script>

Forms Authentication in MVC

index.cshtml

@using (Html.BeginForm("index","home",FormMethod.Post))

{

    @Html.AntiForgeryToken()

    <span>Enter Name</span>

    <input type="text" name="name"  required />

    <input type="submit"  value="Submit" />

}

HomeController.cs

        

        using System.Web.Security;

 [HttpPost]

        [ValidateAntiForgeryToken]

        public ActionResult Index(FormCollection formCollection)

        {

            if (ModelState.IsValid)

            {

                  var authTicket = new FormsAuthenticationTicket(

                    1,// version

                    formCollection["name"].ToString(), // user name

                    DateTime.Now, // created

                    DateTime.Now.AddMinutes(20), // expires

                    false,  // persistent?

                    "User"  // can be used to store roles

                    );

                string encryptedTicket = FormsAuthentication.Encrypt(authTicket);

                var authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);

                System.Web.HttpContext.Current.Response.Cookies.Add(authCookie);         

                return RedirectToAction("about");

            }

            else

            {

                return View();

            }

        }

      

 [Authorize(Roles ="User")]

        public ActionResult About()

        {

            ViewBag.Message = "Your application description page.";

            return View();

        }

       

[Authorize]

        public ActionResult logout()

        {

            FormsAuthentication.SignOut();

            return RedirectToAction("index");      

       

        }

Inside the Global.asax.cs

using System.Security.Principal;

using System.Web.Security;

        protected void Application_AuthenticateRequest(Object sender, EventArgs e)

        {

            HttpCookie authCookie = Context.Request.Cookies[FormsAuthentication.FormsCookieName];

            if (authCookie == null || authCookie.Value == "")

                return;

            FormsAuthenticationTicket authTicket;

            try

            {

                authTicket = FormsAuthentication.Decrypt(authCookie.Value);

            }

            catch

            {

                return;

            }

            // retrieve roles from UserData

            string[] roles = authTicket.UserData.Split(';');

            if (Context.User != null)

                Context.User = new GenericPrincipal(Context.User.Identity, roles);

        }

Inside the web.config

  <authentication mode="Forms" >

    <forms defaultUrl="home/index" loginUrl="home/index"  protection="All"></forms>

  </authentication>

  <authorization>

    <allow users="*"/>

    <deny users="?"/>

  </authorization>