all form.authentication.signout does is release the user session from server memory. it is not going to prevent user from going back to the history pages (assuming history has cached in the browser).
there are few days to handle it, you can:
1) have javascript to manipulate page history by pointing the history to a signoff page
Code:
location.replace('logout.aspx')
or
2) sign SSL (like online banking) and make sure history won't get cache.
"Java is great, PHP sucks and .NET can't scale" - Shaun Connoly, JBoss's vice president of product development. April 5, 2006
Bookmarks