logout by disabling back button

[sandy indira]

hello friends...
i am a new user...

i am creating a web appliction in which i want
if the user is been logout once then he should not be able to access the home page by simply pressing the back button...
i tried different things but it didn't work...


please help...

servlet

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        HttpSession session =request.getSession();

        String name = request.getParameter("username");
        request.setAttribute("uname",name);

        RequestDispatcher rd= request.getRequestDispatcher("/home1.jsp");
        rd.forward(request, response);

    }
}

home page

request.getSession(true);
String val = (String)request.getAttribute("uname"); 
<%= val%>
logout link

logout.jsp

<%
request.getSession(true);
System.out.println("1");
session.invalidate();
System.out.println("2");
response.sendRedirect("logout2.jsp");
%>

logout2.jsp

<%request.getSession(true); %
<H1> Successful log out<</H1>

so pleases help me friends... logout by diabling the back button

[Bear Bibeault]

Please be sure to use code tags when posting code to the forums. Unformatted code is extremely hard to read and many people that might be able to help you will just move along to posts that are easier to read. Please read this for more information.

You can go back and change your post to add code tags by clicking the button on your post.

[Charles 'King]

2 things:

1. Please store your attribute in a session, not the request:

session.setAttribute()

NOT this

request.setAttribute("uname",name);

2. Disable the browser's cache otherwise the user can preview the previous cached page. The homepage should have a check for whether the username stored in the session is null. As an aside, preview authentication standards from other sources, google it

[Seetharaman Venkatasamy]

Welcome to Javaranch Sandeep.

also Have a look at this

[sandy indira]

guys still i am in the same problem...can anyone give me any suggestions to handle it on server side...


after logout the user is sent back to the login page and there if he press the back button the request should go to the controller and
check whether is he properly logged in if yes allow him other wise display the login page...


help guys give me some nice code for this...

[Venu Chakravorty]

Hi, Sandy
Create a Cookie object and send it (response.addCookie(Cookie)) when the user logs in. Before a secure page loads, check whether this cookie exists.
Upon logout delete this cookie (using 'setMaxAge(0)' and then send it).

[Bear Bibeault]

There only needs to be one topic on this subject. Closing this one.