title: session management in servlet jsp
body: <p>I'm currently developing a middle level web-app in J2EE using servlets and JSP. It is just like a Content Management System. My website is working very similar according to my needs, but there are some <em>Questions</em> about <em>the best practices and the bad practices</em> for using <strong>MVC</strong> in J2EE.</p>
  
  <p>Code for user to log-in to app is:   </p>
  
  <pre><code>&lt;c:choose&gt;
      &lt;c:when test="${not empty sessionScope.admin}"&gt;
      &lt;a href="/context/controller?action=add-content"&gt; + Add a Content&lt;/a&gt;
      &lt;/c:when&gt;
      &lt;c:otherwise&gt;
      &lt;a href="/context/controller?action=log-in"&gt; Admin Login&lt;/a&gt;
      &lt;/c:otherwise&gt;
  &lt;/c:choose&gt;
  </code></pre>
  
  <p>Java code in controller servlet is:</p>
  
  <pre><code>if (userDAO.isUser(request.getParameter("uname"), request.getParameter("upass"))) {             
      request.getSession().setAttribute("admin", request.getParameter("uname"));  
      request.getRequestDispatcher("/admin.jsp").forward(request, response);
  } else {
      request.getSession().setAttribute("admin", "");
      request.getRequestDispatcher("/content.jsp").forward(request, response);
  }
  </code></pre>
  
  <p>For log-out:</p>
  
  <pre><code>&lt;a href="/context/controller?action=log-out"&gt;Logout&lt;/a&gt;
  </code></pre>
  
  <p>Java code in controller servlet is:</p>
  
  <pre><code>if (action != null &amp;&amp; action.equals("log-out")) {
          HttpSession session = request.getSession(false);
          if(session != null){
              session.invalidate();
          }
          request.getRequestDispatcher("index.jsp").forward(
                  request, response);
      }
  </code></pre>
  
  <p>I want to know is above logic for log-in, log-out and session management is correct?</p>
  
  <p>And I'm also unable to preventing the user go back to secure page after he is logged-out, how can I set that?</p>