If you have to check for some session variable in all the pages then perhaps you can do this in
AcquireRequestState
event in
global.asax
file. here you can check if the session variable exist or not, if not then you can push the user to a the default page.
void Application_AcquireRequestState(object sender, EventArgs e)
{
HttpContext context = HttpContext.Current;
if(context.session["value"] == null)
{
}
}
Also, You need to check that when is this session variable that you are using is getting killed. chances are that it might not be getting killed and thus simply copying the URL is opening the page.