Java Session-logout button

[Divya Chandel]

Hello All,

I am using MVC for my project and my problem is like this:
I would like to have the user redirected to login page when clicking 'back' button after logging out.
I am aware that clicking back button will give the user a copy of the previous page stored in the browser's cache.
So what I did:-

    response.setHeader("Cache-Control", "no-cache"); 
    response.setHeader("Cache-Control", "no-store"); 
    response.setDateHeader("Expires", 0); 
    response.setHeader("Pragma", "no-cache"); 

Is there any way that when a user logs out and tries to go to a 'cached page' through the 'Back' button be routed to the login page first?

[Swastik Dey]

When the user loggs in you may store the userinfo in a session scoped variable, and the user loggs out you can remove this attribute from session. Now, when the user navigates to any page, you can check whether you have user info in session scope or else redirect the user to login page. This is my though there can always be better options.

[Divya Chandel]

Swastik Dey wrote:When the user loggs in you may store the userinfo in a session scoped variable, and the user loggs out you can remove this attribute from session. Now, when the user navigates to any page, you can check whether you have user info in session scope or else redirect the user to login page. This is my though there can always be better options.

yes I did the same

session.setAttribute("USERNAME", username.toLowerCase());

and in logout

request.getSession(false).removeAttribute("USERNAME");
     session.invalidate();  

and put below code in each jsp page

if (request.getSession(false).getAttribute("USERNAME") == null) {
        response.sendRedirect("./index.jsp");
        return;
    }

[Prasad Krishnegowda]

Divya Chandel wrote:

and put below code in each jsp page

if (request.getSession(false).getAttribute("USERNAME") == null) {
        response.sendRedirect("./index.jsp");
        return;
    }

Writing java code in JSP, is a very bad practice and is discredited for a decade now. Use JSTL.

Also, I would suggest you to read about servlet filters, instead using the java code in JSP to check for user has been logged in or not...

[Jayesh A Lalwani]

Divya,

Do you have the response headers set on every page? Is this problem specific to a browser?

[Divya Chandel]

Jayesh A Lalwani wrote:Divya,

Do you have the response headers set on every page? Is this problem specific to a browser?

No Jayesh, I set response headers only on index page, I mean Login Page, and it's not browser specific

[Bear Bibeault]

Putting Java code on every page is not good advice. I would pay attention to the advice that Prasad Krishnegowda is giving you.

[Vivek SharmaJi]

Hi Divya, You can take some javascript variable and set value 0 to 1 when user logs out, then you detect browser back button using javascript and call a logout function. I mean you can check if browser back button was clicked and your variable value was also 1, when both these conditions are true, you call logout function.

[Bear Bibeault]

Using JavaScript for this is not good advice. JavaScript can easily be disabled.