Preet Dholabhai wrote:my assumption will be wrong if every click on the button produces a new request. i think i got it that it is not possible to do what i am trying to do.
Your assumption is wrong. Each click produces a new request.
There is a "post-redirect-get"
pattern that prevents a post from being resubmitted if the user clicks refresh. I think this might be what you are confusing your scenario with. That wouldn't help you here because you are looking to block the page before.
You'll need two techniques:
1) Set http headers to no-cache so the user doesn't see the page before logging out.
2) Check in your application on each page for a logged in user. You can use a
servlet filter for this.