logout problem

[Adewale Adebusoye]

in my web application, when the user logs out, he or she is redirected to a logout page. the problem is that when the user clicks the "back" button on the browser, he or she is still able to get back into the application.This could constitute a serious security risk. Please how do i get around this?

[Vishnu Prakash]

You got to use response Headers to solve this issue

response.setHeader("Pragma", "no-cache");
response.setHeader("Cache-Control", "no-cache");
response.setHeader("Expires", "0");

[Adewale Adebusoye]

thanks vishnu but where exactly do i insert the code? because its when the user clicks the signout hyperlink that it calls the signout page. theres no servlet/jsp in between even though its part of the overall application.

[Vishnu Prakash]

Include these response headers in those web components(servlets/jsp) which shouldn't be cached(stored) by the browser

[Saket Barve]

It might just be better to abstract out the content into a separate include directive.

Saket

[Vishnu Prakash]

Very good idea. You can even use tag files a latest include in JSP 2.0

[Adewale Adebusoye]

thanks vishnu, i did it and it worked. you're the man.