Nothing, really. I don't know of a way to disable the back button. When the timer event fires, you could pop up a 1x1 window that closes itself, thereby keeping the session alive, or just redirect them to a login page.

window.open("keepalive.asp, "", "left=1, top=1, width=1, height=1")


>And one more thing. Even though your method would result in a user message >indicating that the session has timed-out, what prevents the user from >hitting the BACK button and attempting to reuse a page with his previous >seesion variables now erased secondary to a session timeout.