Member Avatar for khan43

I am trying to clear session variables after I have logged out. In my search.aspx I have a logout button therefore I put the below code in search.aspx.vb. However it does does seem to work.

Protected Sub hlLogout_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles hlLogout
       {



        if(Session["User Name"]!=null) Session.Remove("User Name");
          if(Session["Password"]!=null) Session.Remove("Password");          


  Response.Redirect("Default.aspx");
       }

As I am new to sessions etc. I am not even show if I have put it in the right place, or if I need more code elsewhere in my application. Could anyone help me with this issue?

Thank you

Edited by Nick Evan because: Fixed formatting
  • 2 Contributors
  • 7 Replies
  • 194 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Knvn

Dani AI

Generated

There’s a language/syntax mismatch in the original handler: a VB event signature was paired with C#-style code (curly braces and Session[...] indexers). As pointed out, that causes the compiler error. Pick one language (VB.NET here) and use its syntax consistently — VB uses Session("key"), no braces, and the event handler typically uses Handles hlLogout.Click.

A compact VB.NET logout pattern that clears server session state, signs out an authentication cookie (if you use Forms Authentication), and prevents caching looks like this:

Protected Sub hlLogout_Click(ByVal sender As Object, ByVal e As EventArgs) Handles hlLogout.Click
    System.Web.Security.FormsAuthentication.SignOut()  ' if using forms auth
    Session.RemoveAll()                                ' drop all session items
    Response.Cache.SetCacheability(HttpCacheability.NoCache)
    Response.Cache.SetNoStore()
    Response.Redirect("~/Default.aspx", True)
End Sub

To stop a copied URL or the browser Back button from showing a protected page after logout, put a short check plus no-cache headers on every protected page (Page_Load). Example:

Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs) Handles Me.Load
    Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(-1))
    Response.Cache.SetCacheability(HttpCacheability.NoCache)
    Response.Cache.SetNoStore()

    If Session("UserID") Is Nothing Then
        Response.Redirect("~/Default.aspx")
    End If
End Sub

Quick checklist:

  • Fix the handler so it’s valid VB (no C# syntax).
  • Clear session state server-side (RemoveAll/Clear) and sign out cookies when applicable.
  • Add per-page auth/session checks and set cache headers to prevent back-button replay.
  • Prefer storing a single session/user ID and validate it on each protected page rather than trusting multiple session keys.

These steps address both the compilation error and the two behaviors asked about (logging a user out if they open a URL in a new tab, and preventing back-button re-display of protected content).

Recommended Answers

All 7 Replies

Member Avatar for Knvn

You can just abandon the section using: session.abandon

Member Avatar for khan43

Where should I place this code?

Member Avatar for Knvn

In your code replace

if(Session["User Name"]!=null) Session.Remove("User Name");
if(Session["Password"]!=null) Session.Remove("Password");

with

Session.Abandon();
Member Avatar for khan43

I receive this error below:

Compilation Error
Description: An error occurred during the compilation of a resource required to service this request. Please review the following specific error details and modify your source code appropriately.

Compiler Error Message: BC30287: '.' expected.

Source Error:

Line 23: End Sub
Line 24:
Line 25: Protected Sub hlLogout_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles hlLogout
Line 26: {
Line 27:


Source File: E:\VB Help Guide work\Users\ Line: 25

I am assuming I have placed it in the wrong place, or I have written the code wrong

Member Avatar for Knvn

You are using VB.Net or C#?

@ first glance, I didn't noticed it.
The code

Protected Sub hlLogout_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles hlLogout

is VB.Net and the code

{

if(Session["User Name"]!=null) Session.Remove("User Name");
if(Session["Password"]!=null) Session.Remove("Password");

Response.Redirect("Default.aspx");
}

is C#.

Member Avatar for khan43

Basically What I want to do is. If someone copies the url into a new tab a want it to log the person out. I heard that is called session destroy!

The second thing is if somone logged out, it would take them to the logged out page, then clicked on the back icon it takes them back to the logged in page. What is the best way to avoid both these?

Member Avatar for Knvn

Your error

Source File: E:\VB Help Guide work\Users\ Line: 25

says that it is VB.Net

Before you start programming, it is necessary to know the basic syntax of that language.

I suggest you to learn these things first.
About .Net
* What is .Net
* What are the different types of applications that you can write in .Net
* What are the languages it supports.
* Basic syntax of the language that you are using.

About Programming
* What is variables, conditions, loops etc...
* What is Procedural programming and what is OOPs? , difference b/w these.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.