I'm using
tomcat,
JSF 1.1 and javascript to build a web app. I found that after logging out, the user can click back button and view the page content inside. Although I have tried a few different ways. It seems none of them are working so far.
First, I tried to place some
jsp generated session value passing into javascript function in onload event. I thought once it's logged out, the session value passing into javascript function will become null, but it turns out that when the user use back button to view it, the browser displays cached content instead of going through server side. I even placed meta tags with 'no-cache' values, but its still not working.
Second, I tried to use javascript to get urls in history object and see the logout page has been visited, then I know it has been logged out before. But 'window.history.next' in ie is always getting value of undefined; in firefox, its even not allowed to access history object for security reason.
I see yahoo and hotmail emaill account can do the trick to prevent back button to see the previous page content. How should I implement this?
Thanks.
