>theres a link to the Microsoft KB that explains what each setting is.
Sorry, I missed that earlier.
I played around with the settings, but they don't seem to have any effect. I mean, back button always returns me to the previous page after a logout. In one scenario, I happened to be in the Host-Settings while logged in. Then I logout. Then I press the browser back button. I am returned to Host-Settings. Then I click on "Clear Cache" link. Lo and behold, I get the login page! This shows that (i) the Performance settings dont do what you'd said they were supposed to do in your blog and (ii) some functions are still accessible even on a supposedly secure page even after a logout!
>use case 2: user is logged in, browses to a secure page, clicks logout, clicks back - this is now an attempt to access a secure page whilst not logged in i.e. this is identical to the use case 1
In use case 1, you said the user is shown a login dialog. Then if its identical to use case 1, why isn't he shown the login dialog, at least, if not the home page?
Today I got a small ASP app with salted MD5 hashing implemented on the password field on both client and server, with proper session management and client as well as server side validation. I checked the back button behavior in this app. I found that once I logout, whenever I hit the browser back button, it always returns me to the login page, not the page I visited before the logout. This behavior can be seen in innumerable apps. I don't know why its not possible in DNN. I'd love to see a similar behavior in DNN, either by a code change, for which I'll need some help with or by an upgrade, otherwise I'll have to abandon DNN and try look for other solutions. But that would be a sad day for me.