>This is browser specific. I can't remember the details now, but Internet Explorer always allows you to go back unless the last page was a post and you expired it. GET pages will always be accessible with Back button.
>
>Response.Expires and Response.CachePolicy are the things you want to look at for setting the expiration rules.

Thanks, for all the POSTs, this seems to do the job:

            ' Add the expiration
            oResponse.Expires = -1
            oResponse.Cache.SetCacheability(System.Web.HttpCacheability.NoCache)
            oResponse.Cache.SetAllowResponseInBrowserHistory(False)

I explained the client that for a GET, a page redirect or a URL entered manually in the browser that there isn't much I could do. The only think that would bullet proof that as well would be to encapsulate the URL into a wrapper, which would contain an identifier which could then be used to validate against something at the server level.