如何跳过浏览器中访问页面的历史记录
由于某些安全限制，要求访问的页面不应在浏览器的历史记录中列出。
所以这些页面根本不需要在历史记录中显示。
我尝试过以下方法但失败了。
解决方案 1：
1. <%
2. session.invalidate();
3. response.setHeader("Cache-Control","no-cache");
4. response.setHeader("Cache-Control","no-store");
5. response.setDateHeader("Expires", 0);
6. response.sendRedirect("home.jsp");
7. %>
解决方案 2：
<%
Response.Cache.SetExpires(DateTime.Parse(DateTime.Now.ToString()))
Response.Cache.SetCacheability(HttpCacheability.Private)
Response.Cache.SetNoStore()
Response.AppendHeader("Pragma", "no-cache")
%>
解决方案 3：
<body onload="history.forward()">
解决方案 4：
<%
response.setDateHeader("Last-Modified", System.currentTimeMillis());
%>
与 Firefox 一样，有工具 -> 功能;启动不存储任何会话数据的隐私浏览。 JavaScript 可以做些什么来实现这一点吗？
Due to some security constraints, there is requirement that the page visited should not be listed in browser's history.
So the pages need not to be shown in the history at all.
I have tried following ways but failed.
Solution 1:
1. <%
2. session.invalidate();
3. response.setHeader("Cache-Control","no-cache");
4. response.setHeader("Cache-Control","no-store");
5. response.setDateHeader("Expires", 0);
6. response.sendRedirect("home.jsp");
7. %>
Solution 2:
<%
Response.Cache.SetExpires(DateTime.Parse(DateTime.Now.ToString()))
Response.Cache.SetCacheability(HttpCacheability.Private)
Response.Cache.SetNoStore()
Response.AppendHeader("Pragma", "no-cache")
%>
Solution 3:
<body onload="history.forward()">
Solution 4:
<%
response.setDateHeader("Last-Modified", System.currentTimeMillis());
%>
Like in Firefox, there is functionality Tools -> Start Private Browsing which doesn't store any session data. Is there anything that can be done by JavaScript to achieve this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
当安全很重要时，您不能依赖客户端。所有浏览器对历史记录都有不同的实现。您应该依赖服务器端解决方案。
You can't rely on client side when security matters. All browsers have different implementation for history. You should rely on a server side solution.
您不能使用以上四种方法来完成此操作。
您唯一可以做的就是将您的 URL 设置为唯一且无法根据您的要求重新访问。
You cannot do it using all above four ways.
The only thing you can do it put your URL such that its unique and can't be revisited as per your requirement.
此行为受浏览器而非服务器的控制，因此您的选择非常有限。
实现此目的的一种方法是在站点 A 上创建一个页面，其中仅包含一个 iframe，用于加载您不希望在浏览器历史记录中看到的站点内容。
但它仍然会很脆。用户可以使用“在新窗口/选项卡中打开链接”来突破您的外壳。
如果您有权访问客户端，一种解决方案是安装浏览器并在设置中关闭历史记录，并限制对浏览器首选项的访问，以便用户无法更改此选项。
This behavior is under the control of the browser and not the server, so your options are very limited.
One way to achieve it is to create a page on site A which just contains an iframe that loads the content of the site which you don't want to see in the browser history.
But it will still be brittle. Users can use "Open Link in new window/tab" to break out of your shell.
If you have access to the clients, one solution is to install the browsers with history turned off in the settings plus restrict access to the browser preferences so users can't change this option.
您无法影响浏览器的历史记录机制。您能做的最好的事情就是确保页面没有被缓存，并可能通过使 URL 随机无意义的乱码来“伪装”它。
http://wiki.apache.org/struts/BrowserBackAndSecurity#Data_Caching_vs._Browser_Session_History
You can't affect the browser's history mechanism. The best thing you can do is make sure the page has not been cached and possibly "disguise" it by making the URL random gibberish that has no meaning.
http://wiki.apache.org/struts/BrowserBackAndSecurity#Data_Caching_vs._Browser_Session_History
这有点“默默无闻的安全”的味道。您应该解决真正的问题（URL 中的敏感数据），而不是混淆视听。
只需确保 URL 不包含任何敏感信息（并且请不要将整个页面包装在 iframe 中 - 这又是一种混淆）。
This smells of "security by obscurity". You should tackle the real problem (sensitive data in URLs) instead of obfuscating your way around it.
Just make it so that URLs don't contain any sensitive information (and please don't do it by wrapping the entire page in an iframe - this again is just a bit of obfuscation).