session.invalidate doubt

Hi.
I would like to know why the session.invalidate() doent kill the session completely.

If user click the refresh button he can view the logged out pages also, i.e duplicate form submission.

From where the browser is getting back the data???

where that data is stored??

the data which i am telling is the forwarded data from jsp to servlet, at least the jsp fields data should be destroyed, is there any way to do that??

Thanks and Regards
Adeeb.

session.invalidate() clears the server side session.
For the client side (browser) session, you will need to make sure the window gets closed (manually/javascript)
you can solve the problem of duplicate submission by using session objects as tokens that are validated on that event.
Your browser stores its data (fields, etc) in form of cookies and autoloads the session information. Try clearing your cache/ form autoload information to solve that.

Hi adeeb,

you are asking many question in a single post. and really they are *not* clear to me too.

also Please, UseOneThreadPerQuestion

Thanks for your replies.

In simple words, when i click signout, it is forwarded to logoutservlet, there i have invalidate the session. now when i click back button of browser I get the document expired. That is ok. When i refresh sgain, the page loads. I have gone through the PRG patter, i am unable to implement it, as i am not using any framework. I dint get into my head and trying this since yesterday.

. So i was saying that after the page is refreshed i could still see the old data, how come when the session is invalidated? Means this method invalidate is fooling us around??

Some one guide me to a easire way, only one problem and these many

Thanks

session.invalidate will clear the data, Its not fooling us. If the browser is showing the page, even after session.invalidate, its most likely to be a browser cache..

Is there any way to clear taht cache using servlet. Is it possible???

We have a FAQ entry in JspFaq . NoCacheHeaders . also similar topics discussed many times here. Please Search here for more detail.

check NoCacheHeaders in the servlets FAQ section here..

Thanks for quick reply.

But i already added this still the page loads when refreshed..

adeeb alexander wrote:
But i already added this still the page loads when refreshed..

res.setHeader("Cache-Control","no-store"); //HTTP 1.1 res.setHeader("Pragma","no-cache"); //HTTP 1.0 res.setDateHeader ("Expires", 0); //prevents caching at the proxy server

Hope you have added them in Jsp. well now did you check the valid session there ? if invalid then did you redirect to login page or some where else?

I have tried as you said. Check the below code. Is that what you were saying to do, to check the session?? It dint help, any other way out??

IN JSP

SERVLET

Thanks.

adeeb alexander wrote: Is that what you were saying to do, to check the session??

ohh. noo... I think first you need to thoroughly understand the scope objects in servlet. by the way : you have any idea about javax.servlet.Filter?

<edit>corrected typo</edit>