使用ASP.net中的表单身份验证注销后可以访问页面

Question

I'm using Forms Authentication for user authentication. After login to default.aspx page using login credentials and sign out from default.aspx page and redirect to login.aspx page. after that if I try to load the page default.aspx page by selecting directly from the IE address bar, I could load that page by using previous credentials. Here is the sign out code,

protected void Signout_Click(object sender, EventArgs e)
{
    FormsAuthentication.SignOut();
    Session.Clear();
    Response.Redirect("Logon.aspx");
} 

Here is the authentication part in web.config

    <authentication mode="Forms">
        <forms loginUrl="logon.aspx" name=".ASPXFORMSAUTH" protection="All" path="/" slidingExpiration="true" timeout="60">
        </forms>
    </authentication>
    <authorization>
        <deny users="?"/>
    </authorization>

Here is the process,

1. Login to default page using login credential
2. sign out from default page
3. select the default page directly from address bar.

Answer 1

<location path="Default.aspx">
    <system.web>
        <authorization>
        <deny users ="?" />
       </authorization>
    </system.web>
</location>

This denies the anonymous users from that page (Default.aspx). you can also set the location to an entire folder.

This should be done in we.config file. within the .

hope this helps