Problem with user logout in servlet

Question

Hi friends,
I develop an web application using JSP and Servlet. When the user login it goes to userhome page and when he click the logout link it goes to logout.jsp page. but the problem is when i click my browsers back button it shows the transaction held. How could i stop this. Here is my code
UserServlet.java
int raj=modelBean.validateUser(username,password,role);
if(raj==1)
session.setAttribute("username",username);
if(session!=null)
getServletContext().getRequestDispatcher("/adminhome.jsp").forward(request,response);
else
{ getServletContext().getRequestDispatcher("/login.jsp").forward(request,response);
Here raj is the output of the validateUser() method that checks the DB for username and password. I set the value to 1 if data exists in DB.
Here my adminhome.jsp page
The userservlet redirects to the adminhome if values found in DB..
<% String sid=(String)session.getAttribute("username");
if(sid==null)
response.sendRedirect("expired.html");
%>
Then it displays a table about user information
Here is my logout page
<%
session.removeAttribute("username");
if(session!=null)
session.invalidate();
%>
What should i do to avoid the problem...
Any help would be appreciated

Answer 1

Here is my complete code BalusC,
UserServlet.java (My Controller servlet)
package com.rajk.javacode.servlets;
import java.io.*;
import java.io.PrintWriter;
import java.sql.*;
import javax.servlet.*;
import javax.servlet.http.*;
import javax.servlet.http.HttpSession;
public class UserServlet extends HttpServlet
    public void doPost(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException
        UserModel modelBean = new UserModel();
          PrintWriter op=response.getWriter();
          HttpSession session=request.getSession(true);
        String username = request.getParameter("username");
          String password = request.getParameter("password");
          String role = request.getParameter("role");
         if (username.equals("") && password.equals("")) throw new ServletException
              ("User name or password not specified");
           else
               modelBean.setUsername(username);
                 modelBean.setPassword(password);
                 modelBean.setRole(role);
          try
              int raj=modelBean.validateUser(username,password,role);
                if(raj==1)
                     if(session!=null)
                      getServletContext().getRequestDispatcher("/administratorhome.jsp").forward(request,response);
                     else
                      getServletContext().getRequestDispatcher("/err_login_session.html").forward(request,response);
                else if(raj==2)
                  getServletContext().getRequestDispatcher("/customerhome.jsp").forward(request,response);
                else if(raj==3)
                      getServletContext().getRequestDispatcher("/vendorhome.jsp").forward(request,response);
                else if(raj==4 || raj==5 || raj==6 || raj==9 || raj==7)
                      getServletContext().getRequestDispatcher("/err_login.jsp").forward(request,response);
                else
                     getServletContext().getRequestDispatcher("/err_login.jsp").forward(request,response);
           catch (SQLException e)
              throw new ServletException(e.getMessage());
          request.setAttribute("modelBean", modelBean);
    public void doGet(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException
        getServletContext().getRequestDispatcher("/view.jsp").forward(request, response);
}UserModel.java (Bean file)
package com.rajk.javacode.servlets;
import java.io.*;
import java.sql.*;
import java.util.*;
import javax.servlet.*;
import javax.servlet.http.*;
public class UserModel  extends dbmodel implements Serializable
     private String username;
    private String password;
    private String role;
     private String userid;
     public UserModel()
   public static UserModel load(ResultSet rs) throws SQLException
      UserModel user = new UserModel();
      String value = null;
      value = rs.getString(1);
      if (value != null)
         user.setUserid(value);
      value = rs.getString(2);
      if (value != null)
         user.setUsername(value);
      value = rs.getString(3);
      if (value != null)
         user.setPassword(value);
      value = rs.getString(4);
      if (value != null)
         user.setRole(value);
      return user;
   //Getter and Setter methods
   public String getUserid()
    return userid;
   public String setUserid(String userid)
    this.userid=userid;
     return userid;
   public String getUsername()
    return username;
   public String setUsername(String username)
    this.username=username;
     return username;
   public String getPassword()
    return password;
   public String setPassword(String password)
    this.password=password;
     return password;
   public String getRole()
    return role;
   public String setRole(String role)
    this.role=role;
     return role;
   // Login Validation Method
   public int validateUser(String un,String pwd,String rle) throws SQLException
       String un1=null;
       String pwd1=null;
       String rle1=null;
       String uid=null;
       int result=0;
       System.out.println(un+" "+pwd+" "+rle);
      PreparedStatement pstmt = null;
      ResultSet rs = null;
       connect();
      try
         final String SQL = "SELECT * FROM tbl_user WHERE user_name = '"+un+"'";
            pstmt=con.prepareStatement(SQL);
         rs = pstmt.executeQuery();
         while (rs.next())
               uid=rs.getString("user_id");
                 un1=rs.getString("user_name");
               pwd1=rs.getString("user_password");
               rle1=rs.getString("role");
           if(rle1.equals(rle) & (rle.equals("admin")))
           if(uid.equals(un) & (pwd1.equals(pwd)))
             result=1;
             return result;
             else
              result=4;
               return result;
           else if(rle1.equals(rle) & (rle.equals("customer")))
                if(un1.equals(un) & (pwd1.equals(pwd)))
                result=2;
                return result;
               else
                result=5;
                return result;
           else if(rle1.equals(rle) & (rle.equals("vendor")))
           if(un1.equals(un) & (pwd1.equals(pwd)))
                result=3;
               return result;
            else
             result=6;
             return result;
           else
            result=9;
            return result;
       catch(Exception e)
        result=7;
        return result;
      finally
         if (rs != null)
            rs.close();
         if (pstmt != null)
            pstmt.close();
   //return result;
  Now tell me what code should i put in the admin home or some other page in order to maintain the user session properly. Please give me the code if u have one..
Thanks in advance