Take the 2-minute tour ×

we are developing a web application using Struts 1.2. In that application, when user presses logout, it will logout the user,but when he presses back button, it will take him inside without asking for username and password. Likewise, when we give the url of the page after login, it will take him inside without verification.

I dont know how to reolve this kind of security problem. Please guide me.

share|improve this question
Are you destroying the session in the logout action? –  Manu Dec 13 '10 at 14:08
Do you even use the session for checking the auth state? –  air_blob Dec 13 '10 at 14:28
Is the page from cache? i.e. does it work if you hit back and then refresh? –  CodesInChaos Dec 13 '10 at 14:31
What kind of authentication are you doing? With Basic / Digest Authentication you're not really logging someone out (it keeps sending the authentication data with every request). –  ivy Dec 14 '10 at 14:55
add comment

1 Answer

How did you implement your logout action? If you are implementing your own (say, without using Spring Security, etc), you should be invoking session.invalidate(); when the user is logging out. Sure, when your user hits the back button, they might still see the page due to browser caching (depending how to implement the log out action) but when they try to access a secure page after that, they will not have access to it.

share|improve this answer
add comment

Your Answer


