We Keep Coding

maintain login and logout sessions in asp.net web forms

I am trying to implement login and logout in asp.net(web forms). In my web form I have two pages namely Default and Main. From Default page when I login with username and password it redirects to the Main page. When I press back button it directly redirects to the default page. For this I copied javascript code to my default page
<script type = "text/javascript" >
function preventBack() { window.history.forward(); }
setTimeout("preventBack()", 0);
window.onunload = function () { null };
source from stackoverflow question
After login when I click on back button in my browser(chrome) first it shows the Default page and then it shows the Main page. i.e page blinks when I click the back button.
It shows main page successfully with the issue.
What should I implement to stop showing the Default page when I click on back button
Update:
<script type = "text/javascript" >
history.pushState(null, null, 'Default.aspx');
window.addEventListener('popstate', function (event) {
history.pushState(null, null, 'Default.aspx');
});
</script>
I placed this code in default page

There is one important thing that you ought to know here.
One cannot disable the browser back button functionality only thing that can be done is prevent it.
You can't, in anyway diasble that button. What you can however do, is to put some logic and prevent that button from doing what it is meant to do.
Now for the script that you have shown, it should serve fine and the other thing to try here is to put a mediator page between your default and main page. So when you login, the control will flow to mediator page and it will then redirect to main page. Now when the user presses back button on the main page, the control will flow to mediator page which will again redirect the user to his main page.
The effect will be the same as your script, but putting a page can help you write Session handling code and some server side checks if you want.
But one thing is sure, the browser back button will be as it is.
Hope this helps.

As Matt said you can't disagree the back behaviour. However you can check if the user is logged in and redirect them to the main page easily.
All you need to do is, on the default page check if the user is logged in, if they are then redirect them to the main page, this way even if the user clicks back, they will be taken back to the main page. And also the can go to the Default page after logging out.

Another way could be using location.replace("...."), which replace the existing document and user can't "go back" using back button as the page doesn't exist in the url history.
Src: https://developer.mozilla.org/en-US/docs/Web/API/Location/replace

ASP.NET How to Ensure ViewState is Cleared to Prevent MAC Validation Error at Logon

I have inherited an ASP.NET site (4.5). The site is running on a single server (in a hosted environment) using an automatically generated ViewState encryption key.
Whenever the site is restarted, in spite of users being correctly re-directed to the login page (which is basically an asp:Login control with some text), they will get MAC verification errors until they close their browser.
I would like to know if it is possible/how to ensure that the ViewState is completely culled / cleared whenever a user logs-in to prevent this problem from happening. Do I need to do a brute-force re-direct or something similar?
I note that the login control's DestinationPageUrl is set to a static value, rather than the page in the query string, would this be an issue?
Answers that suggest disabling ViewState validation, generating static keys or implementing persistent ViewState handling will be down-voted. Thanks.

I believe this is well-covered by the SO post linked below, and probably a few others and blogs (googling "viewstate mac validation failed" reveals a number of explanations and fixes.)
Validation of viewstate MAC failed when on page for 20+ minutes
In some cases setting PostBackUrl on the login Button to equal the page name that you will be posting back to will fix the issue.
I had a case where it did not, and I was selling a COTS product and could not always rely on users updating their configuration to avoid this notorious issue. To overcome this issue, I used a little bit of javascript. The solution goes like so:
Create a "splash screen" page which can also function as a screen saver, perhaps it could show a logo and randomly move it around the page every few seconds for a nice effect (I did this). Clicking on or hitting a key on the splash screen page should navigate the user to the login form page URL.
From the Login form, render the value of Session.Timeout (integer in minutes) into javascript.
Write a javascript function that fires on window.load and uses setInterval() or the like to monitor how long the unauthenticated-user has been sitting on your login form. When the session timeout is about to expire, redirect to the splash screen page created in #1.
(Instead of the splash screen method, you could force a refresh of the login form - but if a user leaves their browser on your login form over the weekend this will prevent your ASP.NET app from automatically shutting down due to inactivity (assuming you have a site that has low enough traffic volume to actually shutdown due to inactivity)).
Example code: (put this in your login.aspx)
<script type="text/javascript">
var sessionTimeout = <%=Session.Timeout.ToString()%>;
var sessionTimeoutMs = sessionTimeout * 1000;
var refreshLoginForm = false;
var redirectToSplashPage = true;
setTimeout(function()
{
if(window.console && window.console.log) { window.console.log("ASP.NET Session expired."); }
if(refreshLoginForm)
{
// method 1: refresh login form to get a fresh viewstate
window.location.href = window.location.href;
}
else if (redirectToSplashPage)
{
// method 2: redirect to a splash screen / screen saver page
// that will link back to login form and request a fresh viewstate.
window.location.href = "login_splashscreen.html";
}
}, sessionTimeoutMs);
</script>

How to close current Browser window and redirect to a previously opened window for the same browser

i have two asp page,first one is home and second one is test. In home page user can select the type of test they want to take up, and after pressing start button a new window is open for taking the test. What i want to achieve is , after completing the test i want to close the test window and redirect to another page, and this redirect should hit the previously opened home window.

You don't clarify that you have popup window or blank window i am aspecting for the popup
In submit click button press
String x = "<script type='text/javascript'>window.opener.location.href='**Your new url of new page after completing test**';self.close();</script>";
ScriptManager.RegisterClientScriptBlock(this.Page,this.Page.GetType(), "script", x,false);
From self close you will be able to close current window and by window.opener.location.href you will able to redirect to new url
I hope this will help you
regards....:)

Yes you can do these 2 ways:
Window.Open() /.showmodalDialog() and keep parent and child open as well, or
On the home page click on your start button. Use code Response.Redirect("~/Test.aspx"); assuming it resides with Home.aspx. Take your test using ASp.Net wizard control or hiddens divs what ever suits you easy. Manipulate data on test page , save and get result to and from database using SqlConnection and SqlCommand assuming you have Sql Server as backend. Hold the table or any value in either cache or Session and throw it on your home page. Do whatever you want.

This will be not possible. What you can do is to redirect the user to the home page after completing the test, but this will be in the same windows.

ASP.NET Page loads slow as a popup, but not standalone link

Got a strange one, here.
I'm working on a basic ASP.NET/C# code-behind app where summary data is listed in a grid, and each record has an accompanying "update" button. Clicking the button triggers a window.open() where the ID for each row of the grid is passed into a query string to retrieve the related record for edit in the new window.
Example from the rendered "grid" page:
window.open('EditTool.aspx?ID=' + ID, 'new_window', width=550, height=300');
When the page opens from the button, it can take upwards of 10 seconds to render. When I open a new tab and just paste the URL and query string content into the address bar, the page renders almost immediately.
I've peppered the content of the page with log4net statements, and it looks like all of the controls and code-behind C# executes in a few milliseconds.
For investigation's sake, I've got popup blockers deactivated, and I've tried this on IE7 (workplace standard, ugh), FF, and Chrome.
Any ideas as to how to make the rendering faster, or where else I can look to see what's slowing it down?
Update:
I've created a new shell webapp that has a button opening an empty (just the stuff that gets added when you "Add New Item") ASPX as a popup. The popup renders immediately. I've also modified my existing app to open an empty popup, and I get the same delay. It's looking like the app server is waiting to process something before it starts processing the page, rather than rendering the page, slowly.
Does ASP.NET have a setting where you can tell it not to recompile a page on each render?

asp.net: how do i prevent users from posting the same data multiple times

i have a little asp.net web application.
it is a front end to a sql-server-2008 database.
after they fill out all the data, they will press submit and the data will be sent to the database.
after this point if the user refreshes the page, the data is posted again!!! how do i disable this from happening?

Send a Location header back to the user that redirects the browser to another page: refresh will then reload that other page rather than resubmit the old form.

This is caused by the last request being a POST request to the page, what do you need to do is a redirect so the last request becomes a GET.
After you have handled the post data you can just do a redirect to the same page with:
Response.Redirect("~/ThePage.aspx");
This will prevent you from presenting a message to the user straight from the code behind, if you want to present a success message using this method you will need to add a querystring or something similar:
Response.Redirect("~/ThePage.aspx?result=success");
And then check on the page bind if the querystring to present a success message is set, such a check could look something like this:
if (Request.QueryString["result"] != null && Request.QueryString["result"].ToString().ToLower() == "success")
{
//Show success message
}
Another solution which probably is superior but might require some more work is to wrap the form in a updatepanel, you can read more about it here: http://ajax.net-tutorials.com/controls/updatepanel-control/
An updatepanel will make the form submit with AJAX instead of full postback.

You need to follow the Post/Redirect/Get pattern which is explained on WikiPedia and alluded to by Femi. In your code after you've done your processing do a Response.Redirect to the desired page.

See this article about the PRG pattern: http://en.wikipedia.org/wiki/Post/Redirect/Get
In short, after the user POSTs (submits) data to your server, you issue a Response.Redirect to have the users browser GET a page. This way, if the user presses the reload button, it is the GET request that is repeated.