I´ve a .net 4.5 app with MVC 4 + WebAPI, and I'm facing a situation that I don´t know how to explain/solve.
My Logoff code is as follows:
public ActionResult SignOut()
{
FormsAuthentication.SignOut();
return Redirect("~");
}
This works, somehow, as expected (didn't verified for hacking scenarios).
However, if I do the following:
public ActionResult SignOut() {
{
FormsAuthentication.SignOut();
return Redirect("~/?logout=true");
}
It seems to still work, however, if the user hits the back navigation button on chrome (or backspace), he gets back to the login page!
Can you confirm that the page you are seeing is not the cache version? Press Shift-F5 and see if the page refreshes or if you are redirected to the login page instead. If that is the case, you can play with the cache settings to make sure users cannot go back to the page.