Clear session on Logout MVC 4

Question

I need to know how to clear session on Logout in MVC 4 asp.net I have tried almost every thing but all in vain.

    [AllowAnonymous]
    public ActionResult SignOut()
    {
        Response.AddHeader("Cache-Control", "no-cache, no-store,must-revalidate");
        Response.AddHeader("Pragma", "no-cache");
        Response.AddHeader("Expires", "0");
        Session.Abandon();

        Session.Clear();
        Response.Cookies.Clear();
        Session.RemoveAll();

        Session["Login"] = null;
        return RedirectToAction("Index", "Login");
    }

Session.Clear();
Session.Abandon();
Clear cookies
set session to Null on Logout etc

but when i click on Browser's back button . it redirect to the same account. please help me , how would i clear session variable when i click on logout button. I tried each of the above one by one and then in group but same result.

Please throw some more light.. Authentication type, cookie type? Can you check if you have cleared all cookies? You can check that using browser inspectors.. — GeekzSG, Jan 02 '15 at 06:22

score 3 · Answer 1 · answered Jan 02 '15 at 09:40

When a user clicks the back button, the browser shows the cached version of the page, which is exactly what the user saw when he first downloaded that page. However, there is no contact with the sever at all to show this cached version of the page. The cached version of the page will look exactly as when it was downloaded, so you can see the user that was logged on when the page was downloaded. However, that doesn't mean that user is still logged in.

If you want to avoid the user to navigate back to previous cached pages, the easier way to do it is to remove the browser's history when the user logs out. You cannot do directly that, but there is a workaround that gives the same result. Run this JavaScript:

var Backlen=history.length;   history.go(-Backlen); 
window.location.href='new page url';

So, what you need to do is to return a page with this JavaScript, and, where you read 'new page url' you have to insert the page where you want to redirect the user when he logs out.

Of course, avoiding caching, like in Ravinder Singh's answer is an option, but it's not a good idea to avoid the browser from caching all the pages.

score 1 · Accepted Answer · answered Jan 02 '15 at 06:26

When you click on browser back button, it brings page from cache not from server. But user will not be able to perform any action on page displayed after back button.

If you still want page should not be displayed you should remove cache. It's a best practice. Here is the code. (Write in Global.asax.cs file)

 protected void Application_BeginRequest()
    {
        Response.Cache.SetCacheability(HttpCacheability.NoCache);
        Response.Cache.SetExpires(DateTime.UtcNow.AddHours(-1));
        Response.Cache.SetNoStore();
    }

After writing this code user will not see previous page after pressing back button.

The code written above to make Session object clear is right. No need to change any thing.

Clear session on Logout MVC 4

2 Answers2

Linked