I am doing a j2ee project.In that proj to access the inner page user have to login.In login Servlet we create a session
String u=request.getParameter("uid");
String p=request.getParameter("pass");
User u1=new User();
u1.setId(Integer.parseInt(u));
u1.setPass(p);
Login l1=new Login();
if(l1.loginRequest(u1))
{
u1=l1.getName(u1);
u1.setPass("xxxxx");
session=request.getSession(true);
session.setMaxInactiveInterval(10*60);
session.setAttribute("USER",u1);
request.getRequestDispatcher("service.jsp").forward(request,response);
}
else
{
request.setAttribute("ERROR","Login Unsuccessful");
request.getRequestDispatcher("login.jsp").forward(request,response);
}
Next ,In each jsp page I check this session
<%
if((User)session.getAttribute("USER")==null )
{
request.getRequestDispatcher("login.jsp").forward(request,response);
}
%>
and I have a jsp page logout.jsp .If user click the link of this page then the session will be invalided
<body>
<% session=request.getSession(true);
session.invalidate();
response.sendRedirect("http://localhost:8080/MESS2/index.html");
%>
</body>
But the problem is First time when server is running no session is created then if I put the url in address bar of the browser then it redirect to login page but when I login and
then logout and then put the url in browser address bar that time it is not redirected to login page ,it goes that page. session created by the user is still exists.
But after logout I can't want to give the chanse to user to visit the inner page.