当用户注销后单击“后退”按钮时，会话如何失效，例如银行网站

Question

I am storing session id in database at the time of login and refer the same when different pages are accessed. Session expires after a certain time as I have calculated for session id in each page. Now, My problem is in log out. When I click log out, it works in a way that user if select any thing from menu gets session expired. But if he clicks back button, it takes him to previous page, as session never logged out/expired. How to prevent this page display on back button thing?

Note - In log out, I have created a new session and replaced the old one with it. Following is my code -

import java.io.IOException;
import java.io.PrintWriter;
import java.sql.*;
import java.net.*;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;


//public class LoginToApp extends HttpServlet {
public class LogoutApp extends javax.servlet.http.HttpServlet implements javax.servlet.Servlet {

    private ServletConfig config;

        public void init(ServletConfig config)
            throws ServletException{
            //this.config=config;
            super.init(config);
   }

public void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        response.setContentType("text/html");

        HttpSession session = request.getSession();
        String sessionID;
        String oldsessionID = request.getParameter("sessionID");
        System.out.println("Path Info"+oldsessionID);
        Date createTime;
        Date lastAccessTime;
        long initialtime;

        if(session.isNew()){
            System.out.println("New session created by default");
            request.getSession(true);
            sessionID = session.getId();
            createTime = new Date(session.getCreationTime());
            lastAccessTime = new Date(session.getLastAccessedTime());
            initialtime = System.currentTimeMillis();
         }else{
            System.out.println("You have created a new session");
            session.invalidate();
            session = request.getSession(true);
            sessionID = session.getId();
            createTime = new Date(session.getCreationTime());
            lastAccessTime = new Date(session.getLastAccessedTime());
            initialtime = System.currentTimeMillis();
         }

        try{
                    //java.sql.Statement theStatement=null;
                    java.sql.ResultSet theResultSet=null;
                    /* Create string of connection url within specified format with machine name, port number and database name. Here machine name id localhost and database name is student. */
                    String connectionURL = "jdbc:jtds:sqlserver://localhost/AUTOUDB";
                    // declare a connection by using Connection interface
                    Connection theConnection = null;
                    // declare object of Statement interface that uses for executing sql statements.
                    PreparedStatement thePreparedStatement = null;
                    // Load JBBC driver "com.mysql.jdbc.Driver"
                    Class.forName("net.sourceforge.jtds.jdbc.Driver");
                    int updateQuery = 0;

                        try{
                            /* Create a connection by using getConnection() method that takes parameters of string type connection url, user name and password to connect to database. */
                            theConnection = DriverManager.getConnection(connectionURL, "sa", "islemm*03");
                            // sql query to insert values in the secified table.
                            String queryString = "Update LOGIN set SESSID = ? where SESSID LIKE ?";
                            thePreparedStatement = theConnection.prepareStatement(queryString);
                            thePreparedStatement.setString(1,sessionID);
                            thePreparedStatement.setString(2,oldsessionID);
                            thePreparedStatement.executeUpdate();

                            System.out.println("Old Session ID : " +oldsessionID+ " New Session ID."+sessionID);
                            session.removeAttribute("oldsessionID");
                            response.setHeader("Cache-Control", "no-cache, no-store");
                            response.setHeader("Pragma", "no-cache");
                            response.setHeader("Expires","0");
                            response.setDateHeader("Expires",-1);
                            request.getSession().invalidate();
                            //response.sendRedirect("http://qtp.in.ibm.com:8080/automationutil/pages/loggedOut.jsp");

                            Cookie[] cookies = request.getCookies();
                                if (cookies != null)
                                    for (int i = 0; i < cookies.length; i++) {
                                        cookies[i].setValue("");
                                        cookies[i].setPath("/");
                                        cookies[i].setMaxAge(0);
                                        response.addCookie(cookies[i]);
                                        }


                            response.sendRedirect("/pages/login.html");

                        }catch (Exception e) {
                            e.printStackTrace();
                        }finally {
                            // close all the connections.
                            thePreparedStatement.close();
                            theConnection.close();
                            System.out.println("Disconnected from database in finally.");
                        }


                //  theResultSet.close();//Close the result set
                //  theStatement.close();//Close statement
                    theConnection.close(); //Close database Connection
                    System.out.println("Disconnected from database");


                }catch(Exception e){
                    System.out.println(e.getMessage());//Print trapped error.
                    e.printStackTrace();
                }


    }


    public void destroy()
      {
          // do nothing.
      }



}

Answer 1

You might want to consider a ServletFilter and pass in all your requests through the filter as in :

In your web.xml

<filter>
    <filter-name>secfilter</filter-name>
    <filter-class>com.security.SecurityFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>secfilter</filter-name>
    <url-pattern>*</url-pattern>
</filter-mapping>

Refer this link for more filter configurations .

And in your doFilter of your filter class, check whether the session is expired. If expired, redirect to your home page.

I guess you could use this link as a reference.