How to force one way traffic - JSP Servlet?

Question

JSP "A" displays one quiz question (retrieved out of the database).
When the user hits submit, the "post" info is sent and processed by servlet "B".
Servlet "B" also retrieves a new question out of the database, and sends that new question back to JSP "A" for display.
User submits answer... back to servlet "B" where the process is repeated until the total questions hits 25.
Then another JSP "C" displays the quiz score and that variable gets stored in the database.
My question:
I want to be able to detect if the user hits the back button because if he/she does, my scoring is not correct any longer. Also I want to prevent that the user can see and re-answer a previous question by using the backbutton (only one chance to answer).
*Any ideas on how I can detect if the user hits the back button without using javascript?*
I was told before to compare a hidden field on JSP "A" with a step variable stored in the user's session. Then if these 2 were off (because theback button was hit, the user would be directed to an error/warning page). Exactly what I need! However, I don't see how the value stored in the hidden field in the JSP can be compared to the session variable since the hidden field's value never changes. Correct??? Am I missing something?

Answer 1

No, you'd give each question a number, and keep track on the user's side what questions they've already answered. If the user submits an already-answered question, you could then easily detect that.
If you wanted to be extra paranoid, you could set a random number in another hidden field. When you retrieve the question from the database, select a random number (from a big range, so the user can't easily guess it) and store it in the user's session, and put it in the hidden field. When the user submits their answer, compare the two. If they're not the same, raise an error.
If the user tries hitting the back button and re-submits...then at this point, you would have chosen a new number, but they would be seeing the old old. When they submit again, the numbers wouldn't match.
Also: you should send an Expires: header when you send the JSP page, to prevent the page from being cached. That way, when the user goes to page A, they'll always see the latest question.
A cheater could alter their browser (or use a proxy, or whatever) to cache regardless, but they can't change the fact that the server is tracking which questions have already been asked and what the paranoia number is.