servlet session , after logout , when back button of browser is pressed , again the secure page is shown [duplicate]

Answer 1

Your filter is setting the no-cache headers on the welcome.html only, not on the restricted pages. So whenever the browser requests any of those restricted pages via back button, it will likely show up the cached version. Your filter needs to set the no-cache headers on all restricted pages.

So, you need to change

    if (session == null || session.getAttribute("username") == null) {
        response.sendRedirect("welcome.html"); // No logged-in user found, so redirect to login page.
        response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
        response.setHeader("Pragma", "no-cache"); // HTTP 1.0.
        response.setDateHeader("Expires", 0);
    } else {
        chain.doFilter(req, res);  
    }

to

    if (session == null || session.getAttribute("username") == null) {
        response.sendRedirect("welcome.html"); // No logged-in user found, so redirect to login page.
    } else {
        response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
        response.setHeader("Pragma", "no-cache"); // HTTP 1.0.
        response.setDateHeader("Expires", 0);
        chain.doFilter(req, res);  
    }