Restricting the use of back button without JavaScr

Question

I'm currently involved in an ASP.NET project where I need to restrict the users ability to go back in the page structure using the back button. It is essentially a wizard style navigation and I don't want to give the user the ability to go back from the last step and re-submit the data. JavaScript is not an option unfortunately, so I "solved" it by setting the HttpCacheability in every pages Load event to NoCache. This gives the user the "Page expired" page when he or she clicks the back button. It isn't very elegant at all, and I'm wondering what other options I have to achive the desired results.

Answer 1

Only expose one URL for your entire wizard. The step displayed will depend on session state, which can store what steps they have already completed.

That way there is no "invalid" URL for the user to load.

You should probably consider creating a UserControl for each step. You then place all the steps on a single .aspx page and show and hide them as appropriate.

Answer 2

It's not possible. Even if you get it working in internet explorer in Firefox it will not work.

The only way to handle this is you need to handle saving the state of a users step in either their session, database etc and then when they submit verify that they are submitting on the correct step.

Answer 3

The short answer is "you can't." Because it's browser-side functionality, any method to do this will be via something exposed by the browser, which means it's trivially defeatable. The long answer is you don't want to. This creates usability issues (any changes to normal browser behavior is undesired). I would suggest using a session cookie to determine where in the process they should be and issue a 302 redirect to the appropriate page if they try to access the wrong page of the process (prior to processing any GET/POST data as well as discarding any data they may have been submitting). Trying to defeat the users by altering how the browser's base functionality works will always lead to headaches.

Answer 4

Keep the navigation state on the server side, and if the user hits a page that doesn't correspond with a next/prev click, redirect them to where they were supposed to be.