1

I am currently using SAML token authentication for one of our clients. When I click log-out the session is getting cleared , everything works fine. But when I click the browser back button I can still get in the application. How can I stop this behavior? I don't want the user to see the application once he logs out. I have seen this behavior in most of the banking sites. IS THIS POSSIBLE ? a)Closing browser is not a option. b)Disable Backbutton is not considered.

3
  • What happens if you try to do any action on the backed page? Commented Mar 6, 2014 at 18:28
  • the user is logged out. Suppose a user has entered some personal details , then when i click back button these are visble .
    – Nikhil J
    Commented Mar 6, 2014 at 18:31
  • 1
    Working JS : <script type = "text/javascript" > function disableBackButton() { window.history.forward(); } setTimeout("disableBackButton()",0); </script> <body onunload="disableBackButton()" onload="disableBackButton()"> </body>
    – Nikhil J
    Commented Apr 16, 2014 at 1:52

2 Answers 2

1

You could try to close the tab/window with Javascript in your SignOut.aspx page using window.close(); SP 2013 already does it like this (bad formatting included):

<asp:content contentplaceholderid="PlaceHolderAdditionalPageHead" runat="server">
<SharePoint:ScriptBlock runat="server">
function _spBodyOnLoad()
{
    window.close();
}
</SharePoint:ScriptBlock>
</asp:Content>

It will prompt the user, but there are some (hacky) ways to work around this in some browsers: How can I close a browser window without receiving the “Do you want to close this window” prompt?

Edit:

You say the script you posted "works", but not if the user presses the back button multiple times. This behavior is expected because your script just uses the browser history to navigate forward when a user lands on your sign out page, but if the user navigates back past your page before the script runs they'll be back in the site. The only way to prevent this is to close the tab/window or to clear the browser history. Unfortunately, clearing the browser history is not possible via Javascript (as seen in this SO post: How to clear browsing history using javascript) because that would be a security issue (think about it...).

Therefore, your best (and frankly only) working option is to close the tab. That's what Microsoft did in their sign out page, presumably to solve the same problem you're trying to solve.

If you want to redirect the user to a new URL on sign out, get inventive. Open the target URL in a new tab and then close the tab with the SharePoint browsing history. They wouldn't be able to use the back button then.

12
  • I dont want to close the browser because the ask is to redirect to a different url after logout
    – Nikhil J
    Commented Mar 6, 2014 at 21:10
  • Well, technically this would just close the tab, but what do you mean "the ask is to redirect to a different url"? If you don't close the tab the user will always be able to use the back button to return to the site. If you're trying to say that the question is how to redirect to a different url, that was nowhere in your OP... The code I posted is directly from the SP2013 SignOut.aspx page. This is how MSFT tackled the exact same issue that you're facing. Commented Mar 6, 2014 at 21:26
  • Current Application : Click logout , user is taken to a "Login page" where user enters his/her credentials and logs in the site again . I am saying " If i click logout and clear session and logout the user ,then user shld not be able to use the back button to return to the site"
    – Nikhil J
    Commented Mar 7, 2014 at 18:00
  • 2
    You should try deleting the browser history then :P Commented Mar 7, 2014 at 20:39
  • Could you suggest history clear code/option across all browsers ?
    – Nikhil J
    Commented Mar 8, 2014 at 3:36
0

Logout Code : AJAX Implementation in master page ,works with mozilla , Chrome , iE , safari

<head runat="server">
<script>
     var httpRequest;        
     if (window.XMLHttpRequest) { // Chrome, Mozilla, Safari, ...
         httpRequest = new XMLHttpRequest();
     }
     if (!httpRequest) {
         alert('Giving up :( Cannot create an XMLHTTP instance');            
     }
     httpRequest.onreadystatechange = alertContents;
     httpRequest.open('POST', 'https://Logoutworking.site.com/xyz/SitePages/Home.aspx');
     httpRequest.send();

     function alertContents() {
         if (httpRequest.readyState === 4) {
             if (httpRequest.status === 200) {
             var v = httpRequest.responseText;
                 if(v.indexOf('Access Error') == -1)
                     window.location.replace("https://AABC/aCCESSsError.aspx");
                     } 
                     //else {
                 //alert('There was a problem with the request.');
            // }
         }
     }
</script>

OR if DISABLE BACK on entire site :

<script>
    if (document.URL.indexOf('abc.com') != -1) 
 {
    function noBack()
    {
         window.history.forward()
    }
    noBack();
    window.onload = noBack;
    window.onpageshow = function(evt) { if (evt.persisted) noBack() }
    window.onunload = function() { void (0) }
}
</script> 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.