Invalidate session in Logout Servlet [duplicate]

Answer 1

What you are doing is good. Browser is caching the previous pages, and when you click back button it is taking to previous cached page.

You need to add Cache headers which does not allow browser to cache page.

Cache-Control: no-cache

Answer 2

In every servlet, check whether Session is null or not. If session is not null then only do the request processing else redirect to login page.

HttpSession session  = request.getSession();

if(Session !=null)
{
try
{      
    // acutal servlet actions

}else
{

  // redirect to login page

 }

Also it would be good if you add null check for session in your above code.

HttpSession session  = request.getSession();
if(session !=null)
try
{      
    session.removeAttribute("logonSessData");
    session.invalidate();                               
    String pageToForward = request.getContextPath();
    response.sendRedirect(pageToForward);           }
catch (Exception sqle)
{
    System.out.println("error UserValidateServlet message : " + sqle.getMessage());
    System.out.println("error UserValidateServlet exception : " + sqle);
}
}else
{
  //session already null/ expired
}

Answer 3

This will create a new session

HttpSession ss = request.getSession(true); //creates a new session.
  if(ss.isNew()){
    ss.invalidate();  //this clears the session
    ss = request.getSession(true); // creates a new session 
    }

Answer 4

1)When you are clicking on back button on browser you are getting previous page because of browser cache.

2)When you are clicking on any page after backing you are getting status 500 because there is null pointer exception because of session object is invalidate already.

3)When you refresh new request is going to your servlet or JSP, there your are calling request.getSession(); method, which is creating new session object for you.

as a result you are getting full access to all pages again.

To avoid this problem you can follow the below steps.

1)In the application create one servlet Ex:LoginCheckerServlet

2)for the above servlet give url pattern /*

3)So the servlet will be executed for all the request

4)Now in LoginCheckerServlet check for username and password in request parameters

5)If they are coming perform login checking operation and display welcome page

6)If user name password are not coming, there are two meanings

     i)user is already logged in 

    ii)user is trying to access your app illegally

7)Now call request.getSession(false); method which will give you session object is there is session already existing for this user so you can redirect to welcome page with trust on user.

8)request.getSession(false); will give you null value if there is no session existing for this user.

9)In case if you are not getting username and password in request parameters as well as request.getSession(false); is giving you null value means user is trying to access your application without logging in, now you can happily display forbidden page.

Answer 5

What you need to do is set the session into an attribute based on the session.

request.getSession().setAttribute("sess",request.getSession());

Use this to compare it to the current session. If this comparison fails, then redirect to the login page. This should be done in each page.