c# - Manage user session in ASP.net -

i new in asp.net , first webapp. facing problem in app regarding session when logout , press button of browser again pushes me in app. using code below :

    protected void page_load(object sender, eventargs e)             {                 if (session["liveuser"] != null)                 {                  }                 else                 {                     response.redirect("invalidform.aspx");                 }             }   protected void buttonlogout_click(object sender, eventargs e)         {             response.redirect("loginform.aspx");             session["liveuser"] = null;          } 

button logout :

<asp:button id="buttonlogout" runat="server" cssclass="btnlogout"                     text="log out" onclick="buttonlogout_click" />  

login button code behind :

protected void btnsubmit_click(object sender, eventargs e)         {             string query = "select useractive nworksuser username='" + this.txtusername.text + "' , _password='" + encrypt(this.txtpassword.text) + "';";             mysqlcommand cmd = new mysqlcommand(query, conn);             mysqldatareader rdr;             conn.open();             rdr = cmd.executereader();             string activeuser = "";             while (rdr.read())             {                 activeuser = rdr.getstring("useractive");             }             conn.close();             if (activeuser == "true")             {                 if (trylogin(txtusername.text, txtpassword.text) == true)                 {                     session.add("liveuser",getusername());                     response.redirect("attendanceform.aspx");                 }                 else                 {                     lablemessage.text = "wrong credentials. please try again";                 }             }             else             {                 conn.open();                 query = "select useractive nworksuser username='" + this.txtusername.text + "';";                 mysqlcommand cmd1 = new mysqlcommand(query, conn);                 mysqldatareader rdr1;                 rdr1 = cmd1.executereader();                 activeuser = "";                 while (rdr1.read())                 {                     activeuser = rdr1.getstring("useractive");                 }                 conn.close();                 if (activeuser == "true")                 {                     lablemessage.text = "wrong credentials. please try again";                 }                 else if (activeuser == "")                 {                     lablemessage.text = "user  anavailable..!!";                 }                 else                 {                     lablemessage.text = "user  expired..!!";                 }             } 

if click button of browser after logging out expected behave ask username/password not push again in app. should solution?

logout click event should more this:

protected void buttonlogout_click(object sender, eventargs e) {     session.clear();     session.abandon();     response.redirect("loginform.aspx"); } 

redirect needs last.
also, aware, asp.net post events (button clicks) not browser button friendly, since try post form data again.
log out, use regular href link open signout page method, or use post-redirect-get technique in case of post-back (post-redirect-get asp.net)