Ending a session but user can still log in...

Question

I've created a series of jsp pages, and put headers in them to prevent caching of output. I have a bean to store the user info and the bean is stored in the session.
Fbean u = (Fbean) session.getAttribute("beanname");
When the user logs out, I have:
session.removeAttribute("beanname");
So it works fine at first. The user hits the BACK button and he's taken to a login page. If he presses the BACK button again he's taken to a page where the "PAGE EXPIRED ...hit refresh..." The problem is when I hit the refresh button I'm logged in again as if I didn't even log out.
Can anyone help solve this issue?
I appreciate it,
Thanks,
Lior

Answer 1

"PAGE EXPIRED ...hit refresh..." The problem is when I
hit the refresh button I'm logged in again as if I
didn't even log out.Maybe the problem is in that page what you press refesh on. Are you checking the session to see if the user is a valid logged in user? This is just a guess
So when user logs in it sets a session attribute (let's say his/her username). So on the page where you are refreshing, the first thing you should do is
String loginUsername = (String)session.getAttribute("username");
if (loginUsername.length == 0)
// send user to log out page.
// continue rest of page here