Logout session

Question

I have a filter to control the session of my application.when the user logs in he will be able to access all the jsp pages .
Problem--- Even after user logs out , he is able to directly access the jsp pages , by typing the url .(but before loggin in he would be redirected to login page if
he tries to access any jsp page directly)
What should I do to avoid this problem , (ie when the user hits the "logout" he should not be able to directly access the jsp pages any more , he needs to be redirected again to login page.)
here is the code of my filter(it works fine when the user is not logged and also when the user is logged in for the first time)
package com.bea.genesis.tenantmgmt.utils;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
public class FacesRedirectFilter implements Filter {
     public void doFilter(ServletRequest req, ServletResponse res,
               FilterChain chain) throws ServletException, IOException {
          LoginBean loginBean = new LoginBean();
          HttpServletRequest request = (HttpServletRequest) req;
          HttpServletResponse response = (HttpServletResponse) res;
          HttpSession session = ((HttpServletRequest) req).getSession(true);
          // String relativePath = request.getServletPath();
          // String uri = request.getRequestURI();
          // if(loginBean.getLoginId()== null)
          if (session.isNew()) {
               String relativePath = request.getServletPath();
               if ((relativePath.indexOf("/pages/") >= 0)
                         && relativePath.endsWith(".jsf")) {
                    // int length = uri.length();
                    // String newAddress = uri.substring(0, length-3) + EXTENSION;
                    // response.sendRedirect("login.jsf");
                    RequestDispatcher rd = request
                              .getRequestDispatcher("login.jsf");
                    rd.forward(req, res);
               chain.doFilter(request, response);
          } else {
               String Path = request.getServletPath();
               RequestDispatcher rd = request.getRequestDispatcher(Path);
               rd.forward(req, res);
     public void destroy() {
          // TODO Auto-generated method stub
     public void init(FilterConfig filterConfig) throws ServletException {
          // TODO Auto-generated method stub
Do I need to do anythiing at the logout (related to the session invalidate )
Please provide the code.
thanks

Answer 1

ganeshpuppala wrote:
I am actually just using a logout link Probably not a good idea. You should have a logout servlet that directs you to a "goodbye" page, which could be the login page, but it should be a different URL.
, (its a href tht redirects the page to the login.jsp ) , I cannot invalidate the session here.(ie I cannot create a seperate jsp page for the logout -- how do I I invalidate the sesion here?)
So when the user hits this logout link he is redirected to the login page.
But after tht when he enters the url directly he is able to directly access the pages.
I'd say that the user should request a page inside the site and get the login page instead.
Is this really just a browser cacheing problem?That always serves to confuse the issue.
In general all dynamic pages should be returned with cache supression headers (you could add these headers in your filter).
These include pragma: no-cache cache-control: no-cache, expires <ancient date>