Originally posted by Vinod Iyer:
Invalidate/Kill the session on logout . Check if session is invalidated for every request if its invalidates or new session is created then forward to login/session expired page
even after you do this, the back button takes you to previous page.