Member Avatar for vishalbhavsar

hi all, i tried following code for session management bt i dnt knw where it went wrong? can anyone please help me solve the problem. i want to restrict user going on the prevoius page after logging out when he clicks on the browser's BACK button.

******************************************************************
1) i created login.jsp as follows:

<p><a href="1.jsp">1</a></p>
   <%@ page contentType="text/html;language="java" import="java.sql.*">
   <%
	String username="vishal";
	request.getSession();
	out.println("<br>new session created");
	session.setAttribute("username",username);
	out.println("<br>"+session.getAttribute("username"));
   %>

*********************************************************************
2) then i created 1.jsp as follows:

<%@ page contentType="text/html;language="java" import="java.sql.*" %>
<html>
<body>
<p><a href="logout.jsp">logout</a></p>
<%
	if(session.getAttribute("username")==null)
		response.sendRedirect("Error.htm");	
%>
</body>
</html>

**********************************************************************
3) logout.jsp would be :

<%
	if(session.getAttribute("username")==null)
		response.sendRedirect("Error.htm");	
	else
	{
	  session.setAttribute("username",null);
	  session.invalidate();
	  response.sendRedirect("login.jsp");
	}
%>

*********************************************************************

but above code is not working. can anybody solve this problem? pls? or at least give some modification to it???

Edited by peter_budo because: Keep It Clear - Do wrap your programming code blocks within [code] ... [/code] tags
  • 2 Contributors
  • 2 Replies
  • 412 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by vishalbhavsar

Dani AI

Generated

Short answer: the logout code is fine server-side, but the browser can restore a previously loaded page from its cache or the back/forward (bfcache) snapshot so the page appears even after session.invalidate(). The reliable fix is two-fold: (1) enforce a server-side session check on every protected resource, and (2) make those responses non-cacheable (and/or force a reload when a page is restored from bfcache). did the right thing invalidating the session; was also right to recommend a filter to centralize the checks. (developer.mozilla.org)

Do this centrally with a servlet filter (or equivalent) so every protected JSP/servlet gets the same treatment: set response headers to prevent caching (for example Cache-Control: no-cache, no-store, must-revalidate, Pragma: no-cache, Expires: 0) and check request.getSession(false) for a valid login attribute; if missing, redirect to the login page. Using a filter keeps the logic out of every JSP and is the standard approach. See the Java servlet filter docs and cache-control notes for details. (docs.oracle.com)

Example patterns you can apply immediately:

// filter: set no-cache headers, then check session and redirect if missing
response.setHeader("Cache-Control","no-cache, no-store, must-revalidate");
response.setHeader("Pragma","no-cache");
response.setDateHeader("Expires",0);

HttpSession s = request.getSession(false);
if (s==null || s.getAttribute("username")==null) {
  response.sendRedirect(request.getContextPath()+"/login.jsp");
  return;
}
chain.doFilter(request,response);

Also handle pages restored from bfcache: detect the pageshow event with event.persisted and force a reload so the server-side check runs again. Example:

window.addEventListener('pageshow', function(e){
  if (e.persisted) window.location.reload();
});

The OWASP session guidance and browser bfcache behavior explain why both server checks and cache headers (plus an optional pageshow handler) are necessary for a robust logout. Test in an incognito/private window and with DevTools (Network/Disable cache) while pressing Back to confirm the fix. (cheatsheetseries.owasp.org)

Recommended Answers

All 2 Replies

Member Avatar for vishalbhavsar

sorry but above link is broken..

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.