I have a web application that uses forms authentication. I have location settings in the web.config that prevent access to certain pages for unauthenticated users. If you log in, you are able to access these pages. If you log out, then hit the browser's back button, you see the login page. This is ideal.
I have another web application that needs to do this too, and the settings in the web.config are identical, save for the name attribute of the forms element. Yet, in this case, if I log out and then try to browse back to the protected page, I can still set it. If I click on a button or do something else that performs a postback, I then get redirected to the login page. This is not ideal.
Here's what's in the web.config:
<system.web>
<authentication mode="Forms">
<forms cookieless="UseCookies"
defaultUrl="~/Default.a ...
Go to the complete details ...