spring security on logout

[Megha Singhal]

i want to apply spring security on logout so that it won't maintain session if i click on the back button of the browser, that i don't want to do with history, i have to use spring security.
In the following way i applied in my xml file

<security:http auto-config="true" > <security:intercept-url pattern="/welcome*" access="ROLE_USER" /> <security:form-login login-page="/login" default-target-url="/welcome" authentication-failure-url="/fail2login" /> <security:logout logout-success-url="/logout" delete-cookies="JSESSIONID" invalidate-session="true"/> </security:http>
and my jsp page is

	<a href="<c:url value="j_spring_security_logout" />" > Logout</a>

but still when i am clicking back button after logging out it is showing my welcome page.
i want to end the session.
can anyone suggest me the way to end the session using spring security

[Prasad Krishnegowda]

Post your full security-context.xml, also if you click logout button, is it redirected to /logout properly?

[Megha Singhal]

spring-security.xml

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security" xmlns:p="http://www.springframework.org/schema/p" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd "> <security:http auto-config="true" > <security:intercept-url pattern="/welcome*" access="ROLE_USER" /> <security:form-login login-page="/login" default-target-url="/welcome" authentication-failure-url="/fail2login" /> <security:logout logout-success-url="/logout" delete-cookies="JSESSIONID" invalidate-session="true"/> </security:http> <security:authentication-manager> <security:authentication-provider> <security:jdbc-user-service data-source-ref="dataSource" users-by-username-query="select username, password, active from users where username=?" authorities-by-username-query="select us.username, ur.authority from users us, user_roles ur where us.user_id = ur.user_id and us.username =? " /> </security:authentication-provider> </security:authentication-manager> </beans>

yes i can see the login page on logout but when i am clicking on back button i can see my welcome page

[Prasad Krishnegowda]

You have configured logout success url as /logout, how are you seeing the login page? Are both /login and /logout same?

Can you just check, what happens if you directly try to access the welcome page, without logging in and see if its redirecting you to login page?

[Megha Singhal]

in my controller class i have mentioned like this so it is redirecting me to the login page , when i am clicking on logout

@RequestMapping(value="/logout", method = RequestMethod.GET)  
public String logout(ModelMap model) {  
 
return "login";  
 
}  

[Prasad Krishnegowda]

Simply, you can configure the log out success url as /login..

can you check this..
what happens if you directly try to access the welcome page, without logging in and see if its redirecting you to login page?

[Megha Singhal]

No..directly i cannot access welcome page directly..

[Prasad Krishnegowda]

It can be possible that you are seeing a cached page from the browser, after logout can you just delete the cache of your browser and check clicking back.

If its redirecting back to login page, then we can prevent caching of the JSP Pages..

[Megha Singhal]

but i don't want that cached page should appear.. i want that that it should not allow me to go back and when i click on back button login page should refresh and appears again.

[Prasad Krishnegowda]

<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" /> <meta http-equiv="Pragma" content="no-cache" /> <meta http-equiv="Expires" content="0" />
Add the above line to your JSP pages. This will prevent caching of the pages..