Log out functionality

[John Ray Allen]

Can anyone pls help me on my problem regarding the logout functionality of my application..I have a log-in page and several pages in between the log-in and log-out page..my problem is that when I log-out on my logout.jsp once I hit the browsers back buton it displayed the previous page thus the functionality of log-out was not performed...I have tried the session.invalidate() but it doesn't work..wanna hear your ideas and suggestions..thanks!
[ June 05, 2005: Message edited by: Bear Bibeault ]

[Steven Bell]

Hitting the back button displays a page from the browsers cache. This does not indicate that your logout functionality does not work.

[John Ray Allen]

what I want to do is that to totally logout of the page so that whenever I hit the browsers back button it doesnt bring back my previous pages as well as other inputted information from the user..Some articles said that it has something to do with the session but I'm still confused on how to handle my sessions properly..need more explanation if you dont mind or an actual working example...thanks!

[Steven Bell]

You have no control over the browsers back button.

What you can do is check for 'stale' pages. If a user uses the back button after logout they will see the page, but if they try to submit somthing from that page the session will no longer be there because you have invalidated it. You just have to check for the session before you do anything with a submit from a page that requires login.

[John Ray Allen]

or is there a way that the page would forced to expire when browser's back button is being hit..maybe thats the most effective way for user not to hit thw back button anymore..thanks

[Ben Souther]

You can add directives to keep the pages from caching.
Look up
"pragma"
"no-cache"
"expires"
There are several ways to do this, and you will often have to use more than one to cover all browsers.

[John Ray Allen]

I have tried that Ben..it works but after a certain time what i want to do is that once i display the logout page all the remaining pages whether the user hit the browser button or the history button the rest would display the Page has been expired page..

[Naresh Chaurasia]

Hi,
May be you can try out this :

At the beginning of the doGet/doPost method check whether the session is invalid, and in that case re-direct it to an error page.

java pro

[Steven Bell]

If the user uses the history you can show a 'page expired' message with what 'java pro' has suggested. If the user uses the back button the caching directives Ben mentioned will work, but there is no garuntee. You have no control over that because the browser does not go to your site again to get that page, it will pull it out of it's own cach and see the site from when the user was logged in. You just have to build the page so that if you get a request without a session you can handle it.

By the way 'java pro' you will be asked to change your name to meet the naming standards of the site. They require a real (sounding) first and last name.

[Bear Bibeault]

"java pro",

You have already been asked to change your display name to comply to Ranch standards. Take a look at the JavaRanch Naming Policy and adjust your display name to match it prior to your next post.

bear
Forum Bartender
[ June 07, 2005: Message edited by: Bear Bibeault ]