Issue with logging out in adf security

Question

I have three pages. Login, error and welcome.
The first page visible during runtime is login.
I have username, password fields and login button in it.
the action of login button is mapped to this :
public String doLogin() {
        byte[] pw = getSPassword().getBytes();
        FacesContext ctx = FacesContext.getCurrentInstance();
        HttpServletRequest request =
            (HttpServletRequest)ctx.getExternalContext().getRequest();
        CallbackHandler handler =
            new SimpleCallbackHandler(getSUserName(), pw);
        try {
            Subject mySubject = Authentication.login(handler);
            ServletAuthentication.runAs(mySubject, request);
            ServletAuthentication.generateNewSessionID(request);
            String loginUrl =
                "/adfAuthentication?success_url=/faces" + "/Welcome.jspx";
            HttpServletResponse response =
                (HttpServletResponse)ctx.getExternalContext().getResponse();
            sendForward(request, response, loginUrl);
        } catch (FailedLoginException fle) {
            FacesMessage msg =
                new FacesMessage(FacesMessage.SEVERITY_ERROR, "Incorrect Username or Password",
                                 "An incorrect Username or Password" +
                                 " was specified");
            ctx.addMessage(null, msg);
        } catch (LoginException le) {
            reportUnexpectedLoginError("LoginException", le);
        return null;
    }This takes me to welcome page.
I have a golink control in this page.
The destination of golink is:
"#{securityContext.authenticated ? "/adfAuthentication?logout=true&end_url=/faces/Error.jspx"
: "/adfAuthentication?success_url=/faces/Login.jspx"} "
(I dont know what this el means. i believe it sets logout to false)
It takes me to error page.
I believe I should be logged out now. But when I press back in browser it takes me back to welcome page.
I put an af:output text with value security.authenticated and it shows true.
So created a servlet
public class LogoutServlet extends HttpServlet {
    public void init(ServletConfig config) throws ServletException {
        super.init(config);
    public void doGet(HttpServletRequest request,
                      HttpServletResponse response) throws ServletException,
                                                           IOException {
        request.getSession(true).invalidate();       
        response.sendRedirect("faces/Error.jspx");
    public void doPost(HttpServletRequest request,
                       HttpServletResponse response) throws ServletException,
                                                            IOException {
        doGet(request, response);
}registerd it in web.xml as url pattern logout.
Set the destination of golink as logout.
But still the same results.
Where did i go wrong?
the role of welcome.jspx is authenticated-role
Edited by: josetuttu on Jul 7, 2011 2:17 AM

Answer 1

Hi , your problem is arising when user presses the back button of the browser , web browser shows the page from its cache. If you want that
on pressing the back button users should not view the previous pages you must stop web browser from caching the page to its local memory.
It can be done by adding the following code in the jsp:root tag of jsf (.jspx) page.
  <jsp:scriptlet>
  // Set to expire far in the past.
      response.setDateHeader("Expires", 0);
  // Set standard HTTP/1.1 no-cache headers.
     response.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
  // Set IE extended HTTP/1.1 no-cache headers (use addHeader).
     response.addHeader("Cache-Control", "post-check=0, pre-check=0");
  // Set standard HTTP/1.0 no-cache header.
     response.setHeader("Pragma", "no-cache");
</jsp:scriptlet>Now when ever page is loaded the web browser will never cache the local copy of web pages and hence users will not be allowed to view previous pages when clicking back button
on browser .
Hope this helps.