This is implemented through Authentication and Authorisation

In the web.config file 
set the Authentication tag as 
<authentication mode="Forms">
      <forms name="myforms" loginUrl="LoginPage.aspx" >
        </forms>
</authentication>
This means you are using forms authentication and the login 
page name is LoginPage.aspx.

and the autorisation tag as 
 <authorization>
      <deny users="?"/>
    </authorization>
This means deny unauthenticated users. 

In the LoginPage's Authentication Logic use the following 
code if the user is valid. 
FormsAuthentication.RedirectFromLoginPage
(txt_UserName.Text, false);

In the logic of the Signout button use
FormsAuthentication.Signout();

In all innerpages set the following code in the pageload
Response.Expires = 0;
Response.CacheControl = "no-cache";

For complete explanation refer Forms Authentication and 
authorization in msdn.

Hi Lilly!
We have to write logic for that. Set History property to -1
or 0.