title: Spring Security : Problem with the back button
body: <p>I am trying to use the logout functionality provided by Spring security.</p>
  
  <p>The logging out works fine. The session gets invalidated(by calling <strong>logout</strong> method in <strong>SecurityContextLogoutHandler</strong> class). The user is redirected to the login page.</p>
  
  <p>However, when I press the back button, I see the below code having a valid session id.The 
  req.getRequestedSessionId() is <strong>NOT</strong> null. A <strong>New</strong> session is created.</p>
  
  <pre><code>      if (req.getRequestedSessionId() != null &amp;&amp; 
              !req.isRequestedSessionIdValid())
          {
             chain.doFilter(request, response);
             return;
          }
  </code></pre>
  
  <p>We also have the following code in the <strong>LogoutFilter</strong>.</p>
  
  <pre><code>          HttpServletResponse resp = (HttpServletResponse) res;
          resp.setHeader("Expires", "Tue, 03 Jul 2001 06:00:00 GMT");
          resp.setHeader("Last-Modified", new Date().toString());
          resp.setHeader("Cache-Control", "no-store, no-cache,
                                      must-revalidate, max-age=0, 
                                      post-check=0, pre-check=0");
          resp.setHeader("Pragma", "no-cache");
  </code></pre>
  
  <p>Is it some problem with browser? Am I missing something?</p>