session invalidate Pro

[Khanjan]

I have a JSP application which uses Session to store session values. I am having problem
invalidating the session. After logout i am able to access the application by clicking the browsers
back button and refreshing the page.

I use this code in Logout.jsp

<%if(session!=null)
{

session.invalidate();
}
%>response.sendRedirect(loginpage.html)


Can anybody explain what's wrong here?

 

[byam]

This may explains your situtation:

http://www.mail-archive.com/struts-user@jakarta.apache.org/msg14719.html

 

[Khanjan]

Hi,

Isnt there any other way than using saveToken() and struts..?

 

[byam]

If not using Struts, you can apply the same token idea. Use session ID as token and put that as a hidden field in the login form page. In the login process, if the token value is not the same as current session ID, then it is not a valid login.

In your logout page, you put

<%@ page session="false"%>

In your login page, within the login form:

<form ....>
<input type="hidden" name="sessionId" value="<%= session.getId() %>"/>

...

</form>

Then in the JSP or serlvet that process login:

<%
    String loginPageSessionId = request.getParameter("sessionId");

    if (loginPageSessionId==null 
        || !loginPageSessionId.equals(session.getId())) {
        // this is a login page refresh after logout
        response.sendRedirect("login.jsp");
        return;
    }
%>