There's no true way to prevent a user from *viewing* an old page. He's already got that web page in his cache somewhere; one way or another he can view it. Here's what's probably your concern: You don't want him to do something out of order, or to do it twice... For instance, he's on an order form, he clicks submit, and while the results page is being processed, he clicks 'stop' or 'back' and submits it again in frustration. Now you've got two orders... am I close?
A great way to prevent this is to use a token. Here's how it's done:
While processing the request:
1) Randomly generate a token (integer).
2) Save the token to the user session.
3) Embed the token as a hidden parameter <input type=hidden ...> in the form (or forms) that you want to protect.
4) Send him the response.
While processing the following request:
5) Retrieve the token from the session.
6) Retrieve the token Parameter from the user request.
7) Compare the tokens.
8) If the tokens match, process the user's request
9) If the tokens don't match, then do not process the user's request, and instead tell the user to behave himself.
