1

I am currently using SAML token authentication for one of our clients. When I click log-out the session is getting cleared , everything works fine. But when I click the browser back button I can still get in the application. How can I stop this behavior? I don't want the user to see the application once he logs out. I have seen this behavior in most of the banking sites. IS THIS POSSIBLE ? a)Closing browser is not a option. b)Disable Backbutton is not considered.

  • What happens if you try to do any action on the backed page? – Arsalan Adam Khatri Mar 6 '14 at 18:28
  • the user is logged out. Suppose a user has entered some personal details , then when i click back button these are visble . – Nikhil J Mar 6 '14 at 18:31
  • 1
    Working JS : <script type = "text/javascript" > function disableBackButton() { window.history.forward(); } setTimeout("disableBackButton()",0); </script> <body onunload="disableBackButton()" onload="disableBackButton()"> </body> – Nikhil J Apr 16 '14 at 1:52
1

You could try to close the tab/window with Javascript in your SignOut.aspx page using window.close(); SP 2013 already does it like this (bad formatting included):

<asp:content contentplaceholderid="PlaceHolderAdditionalPageHead" runat="server">
<SharePoint:ScriptBlock runat="server">
function _spBodyOnLoad()
{
    window.close();
}
</SharePoint:ScriptBlock>
</asp:Content>

It will prompt the user, but there are some (hacky) ways to work around this in some browsers: How can I close a browser window without receiving the “Do you want to close this window” prompt?

Edit:

You say the script you posted "works", but not if the user presses the back button multiple times. This behavior is expected because your script just uses the browser history to navigate forward when a user lands on your sign out page, but if the user navigates back past your page before the script runs they'll be back in the site. The only way to prevent this is to close the tab/window or to clear the browser history. Unfortunately, clearing the browser history is not possible via Javascript (as seen in this SO post: How to clear browsing history using javascript) because that would be a security issue (think about it...).

Therefore, your best (and frankly only) working option is to close the tab. That's what Microsoft did in their sign out page, presumably to solve the same problem you're trying to solve.

If you want to redirect the user to a new URL on sign out, get inventive. Open the target URL in a new tab and then close the tab with the SharePoint browsing history. They wouldn't be able to use the back button then.

|improve this answer|||||
  • I dont want to close the browser because the ask is to redirect to a different url after logout – Nikhil J Mar 6 '14 at 21:10
  • Well, technically this would just close the tab, but what do you mean "the ask is to redirect to a different url"? If you don't close the tab the user will always be able to use the back button to return to the site. If you're trying to say that the question is how to redirect to a different url, that was nowhere in your OP... The code I posted is directly from the SP2013 SignOut.aspx page. This is how MSFT tackled the exact same issue that you're facing. – RJ Cuthbertson Mar 6 '14 at 21:26
  • Current Application : Click logout , user is taken to a "Login page" where user enters his/her credentials and logs in the site again . I am saying " If i click logout and clear session and logout the user ,then user shld not be able to use the back button to return to the site" – Nikhil J Mar 7 '14 at 18:00
  • 2
    You should try deleting the browser history then :P – Arsalan Adam Khatri Mar 7 '14 at 20:39
  • Could you suggest history clear code/option across all browsers ? – Nikhil J Mar 8 '14 at 3:36
0

Logout Code : AJAX Implementation in master page ,works with mozilla , Chrome , iE , safari

<head runat="server">
<script>
     var httpRequest;        
     if (window.XMLHttpRequest) { // Chrome, Mozilla, Safari, ...
         httpRequest = new XMLHttpRequest();
     }
     if (!httpRequest) {
         alert('Giving up :( Cannot create an XMLHTTP instance');            
     }
     httpRequest.onreadystatechange = alertContents;
     httpRequest.open('POST', 'https://Logoutworking.site.com/xyz/SitePages/Home.aspx');
     httpRequest.send();

     function alertContents() {
         if (httpRequest.readyState === 4) {
             if (httpRequest.status === 200) {
             var v = httpRequest.responseText;
                 if(v.indexOf('Access Error') == -1)
                     window.location.replace("https://AABC/aCCESSsError.aspx");
                     } 
                     //else {
                 //alert('There was a problem with the request.');
            // }
         }
     }
</script>

OR if DISABLE BACK on entire site :

<script>
    if (document.URL.indexOf('abc.com') != -1) 
 {
    function noBack()
    {
         window.history.forward()
    }
    noBack();
    window.onload = noBack;
    window.onpageshow = function(evt) { if (evt.persisted) noBack() }
    window.onunload = function() { void (0) }
}
</script> 
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.