title: When I Log-out and click browser back button I still can create,edit and delete users in MVC4 application
body: <p>My application  let me to create,edit and delete user after I log-out. Although I have created session variable soon after user get authenticated and also removed it on log-out. However in mvc4 I am unable to figure out where to check these session variable condition( null or not). Like in asp.net(c#)page_load was the page where we could implement if condition. </p>
  
  <p>Throughout internet people were discussing about disabling browser back button with java script and also  deleting cookies but in my case once user logs out and if he uses browser back button to look the content and if clicked it should redirect to log in page. </p>
  
  <p>Can somebody assist me in finding the right place to check the condition for session variable null or not. Is it view? Is it share_layout view? Or is it controller? Or something else I have no hint please help.</p>
  
  <p>Here is my session controller code </p>
  
  <pre><code>[HttpPost]
      [AllowAnonymous]
      [ValidateAntiForgeryToken]
      public ActionResult LogIn(User user)
      {
          try
          {
              if (ModelState.IsValid)
              {
                  var userdb = db.User.Include("Role").Single(c =&gt; c.userName == user.userName);
                  if (userdb.passWord == user.passWord)
                  {
                      Session["UserId"] = userdb.userId;
                      Session["UserName"] = userdb.userName;
                      Session["RoleName"] = userdb.Role.roleName;
  
  
                      if (userdb.Role.roleName == "Employee")
                      {
                          return RedirectToAction("Index", "Employee");
                      }
                      else if (userdb.Role.roleName == "Customer")
                      {
                          return RedirectToAction("Index", "CustomerSite");
                      }
                      else if (userdb.Role.roleName == "Admin")
                      {
                          return RedirectToAction("Index", "Admin");
                      }
                  }
   else
                  {
                      ViewBag.errorMsg = "We cannot authenticate you please use the right username or password";
                      return View();
                  }
              }
              return View();
          }
  </code></pre>
  
  <p>And for Log-out</p>
  
  <pre><code> public ActionResult Logout()
      {
          Session.Remove("UserId");
          Session.Remove("UserName");
          Session.Remove("RoleName");
          return RedirectToAction("LogIn", "Session");
  
      }
  </code></pre>