How to properly invalidate JSP session?

Question

So here is the problem. When a user logs out of my website, they can still hit the back button and continue using the site. To keep track of whether the user is logged in or not

Answer 1

All my JSP's have no-cache headers (via @include directives). I have a logout.jsp in the root of the app with the following lines:

HttpSession sessIfAny = request.getSession(false);
if (sessIfAny != null) sessIfAny.invalidate();

This prevents creating unnecessary sessions.

The web.xml needs to exempt logout.jsp from authentication:

    
        excepted
        /logout.jsp
        /favicon.ico
        
    
    

This prevents a login page being shown to do a logout on an expired session.