在MVC Razor中注销后用户按“后退”按钮时，如何防止身份验证？

Question

I have written the code for preventing user Authentication in my GET Method like below

if (!string.IsNullOrEmpty(Session["UserName"].ToString()))
            {
                MyConnection mycon = new MyConnection();
                string str = "";
                int res = 0;
                if (Request.QueryString.ToString().Contains("ID1"))
                {
                    str = "Delete from PostTable where PostID=" + Request.QueryString["ID1"];
                    res = mycon.IODPost(str);
                }
                return View(AllPostList());
            }
            else
            {
                return RedirectToAction("Home", "Home");
            }

but when i press Back button in browser after signout, the page is postback to the previous page which can't be done.. so what should i do to prevent this?

Answer 1

so there are several bad practices in your example.

1. be aware of sql injection - use ADO.NET SqlCommand and SqlCommandParameter classes to create queries.

2. ASP MVC has attributes like [Authorized] , [AllowAnonymous] that can guid your app workflow for each request. You can add these at the controller lever, or method level.

3. Check for null againts "Session["UserName"].ToString()"

Some links :

http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.parameters.aspx

http://msdn.microsoft.com/en-us/library/system.web.mvc.authorizeattribute(v=vs.108).aspx#using_authorizeattribute

hope this helps