I assume your login assigns a session. If so, than on logout do
session.invalidate() Pushing back on the browser may still show the
site but it should only be a version of the site in the cache. If the user
tries to actually submit anything, or reload the site, it should not work.

on the login page, you create a session as follows:

JSP Syntax (Toggle Plain Text)

HttpSession session = request.getSession(true);

HttpSession session = request.getSession(true);

this will create a session if none exists.

During the rest of the users activities, all other pages should use the
following:

JSP Syntax (Toggle Plain Text)

HttpSession session = request.getSession(false);

HttpSession session = request.getSession(false);

This will return null if there is no valid session. So check for this.

If anything happens (i.e. the login fails or you go to the logout page),
do the following:

JSP Syntax (Toggle Plain Text)

session.invalidate();

session.invalidate();

This will invalidate the session so that further getSession calls using false
return null.

This is the basic session process/life cycle.

The login itself, you can still do yourself, and if it fails, just invalidate
the session, as mentioned above. If it succeeds, then continue with the
site, and on the logout page, invalidate the session again.