Groups > comp.lang.java.programmer > #36173

Re: Browser Back Button

Path	csiph.com!feeder.erje.net!2.eu.feeder.erje.net!news2.arglkargh.de!news.mixmin.net!aioe.org!.POSTED!not-for-mail
From	Arne Vajhøj <arne@vajhoej.dk>
Newsgroups	comp.lang.java.programmer
Subject	Re: Browser Back Button
Date	Sun, 8 Jan 2017 19:30:20 -0500
Organization	Aioe.org NNTP Server
Lines	46
Message-ID	<o4uliq$181n$1@gioia.aioe.org> (permalink)
References	<9fc9d84a-b4a7-45a6-a47a-ab7d885bf5ce@googlegroups.com>
NNTP-Posting-Host	PBuS014lhzVyHjLbXmo/ZQ.user.gioia.aioe.org
Mime-Version	1.0
Content-Type	text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding	8bit
X-Complaints-To	abuse@aioe.org
User-Agent	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0
X-Notice	Filtered by postfilter v. 0.8.2
Xref	csiph.com comp.lang.java.programmer:36173

Show key headers only | View raw

On 1/8/2017 6:41 PM, Davej wrote:
> I am playing with a simple login/logout scheme using a combination
> of JSP and servlets, but apparently I'm not understanding the
> ideal procedure to prevent odd results from the use of the browser
> BACK button.
>
> In the Login.jsp page I post a password and username to LoginServlet.
>
> In LoginServlet I validate the password and add the member object
> to the session...
>
> request.getSession().addAttribute("member");
>
> Then I forward to the Membership.jsp page. From Membership.jsp
> I can click a logout button which posts to LogoutServlet where
> I use...
>
> request.getSession().removeAttribute("member");
> request.getSession().invalidate();
>
> ...and then forward back to the Login.jsp page.
>
> The problem is that if I immediately log out after logging in
> and then use the browser BACK button the browser will resend
> the username and password parameters and log me back in again.
>
> "This document is no longer available.
> The requested document is not available in Firefox’s cache.
> As a security precaution, Firefox does not automatically
> re-request sensitive documents.
> Click Try Again to re-request the document from the website.
>
> [Try Again]"
>
> I guess this is just an odd little quirk, but is there perhaps
> an easy way to prevent this?

I don't think there is anything servlet/JSP specific in the
problem.

Long time since I have worked with stuff like this, but I believe
one way of handling it is to redirect instead of forward.

Arne

Thread

Browser Back Button Davej <galt_57@hotmail.com> - 2017-01-08 15:41 -0800
  Re: Browser Back Button Arne Vajhøj <arne@vajhoej.dk> - 2017-01-08 19:30 -0500
    Re: Browser Back Button Arne Vajhøj <arne@vajhoej.dk> - 2017-01-08 20:20 -0500
      Re: Browser Back Button Davej <galt_57@hotmail.com> - 2017-01-10 15:29 -0800
        Re: Browser Back Button Arne Vajhøj <arne@vajhoej.dk> - 2017-01-10 19:49 -0500
          Re: Browser Back Button Robert Klemme <shortcutter@googlemail.com> - 2017-01-11 19:13 +0100
            Re: Browser Back Button Davej <galt_57@hotmail.com> - 2017-01-21 11:43 -0800
              Re: Browser Back Button Robert Klemme <shortcutter@googlemail.com> - 2017-01-22 13:52 +0100
                Re: Browser Back Button Davej <galt_57@hotmail.com> - 2017-01-22 08:34 -0800
  Re: Browser Back Button Marcel Mueller <news.5.maazl@spamgourmet.org> - 2017-01-09 19:35 +0100
    Re: Browser Back Button Arne Vajhøj <arne@vajhoej.dk> - 2017-01-09 19:42 -0500
      Re: Browser Back Button Robert Klemme <shortcutter@googlemail.com> - 2017-01-10 08:03 +0100
        Re: Browser Back Button lewbloch@gmail.com - 2017-01-10 11:30 -0800

csiph-web