You can consider, disabling the caching of a page in the browser. For doing so, see this: https://coderanch.com/t/414250/JSP/java/back-button#1826301 Once this is done, any back button would result in the page being fetched from the server, and in the server you can handle your requirement, like invalidating the session(if it exists) and creating a new one.
Thanks and Regards
I don't even know how to spell CIA. But this tiny ad does: