logout form using cookies servlets jsp

Question

I am trying to make a log out form in java and I am using cookies. But the problem is that when I hit the back button it redirects me to the last secured page witch I don't want.

Here is my code: servlet:

 @WebServlet(name="LogOut", urlPatterns={"/LogOut"})
public class LogOut extends HttpServlet {
 protected void doPost(HttpServletRequest req, HttpServletResponse response1)  
       throws ServletException, IOException {


    Cookie[] cookies = req.getCookies();
    if(cookies != null){
    for(Cookie cookie : cookies){
        if(cookie.getName().equals(req.getSession().getAttribute("email"))){
            System.out.println( req.getSession().getAttribute("email") +cookie.getValue());
        }
        cookie.setMaxAge(0);
        response1.addCookie(cookie);
    }
    }
     //invalidate the session if exists
     HttpSession session = req.getSession(false);
     System.out.println("User="+req.getSession().getAttribute("email"));
     if(session != null){
        session.invalidate();
    }
     //no encoding because we have invalidated the session
     response1.sendRedirect("index.html");
 }
}



filter:



    @WebFilter("/NoCacheFilter")
public class NoCacheFilter implements Filter {
  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;

        response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
        response.setHeader("Pragma", "no-cache"); // HTTP 1.0.
        response.setDateHeader("Expires", 0); //Proxies. 

        chain.doFilter(req, res);
    }
}

jsp:

<form action="logout" method="post">
                        <a><button type = "submit" class = "myprofile>Deconectare</button></a>
</form>

web.xml:

  <servlet>
    <servlet-name>logout</servlet-name>
    <servlet-class>user.LogOut</servlet-class>
 </servlet>
 <filter>
    <filter-name>nocachefilter</filter-name>
    <filter-class>user.NoCacheFilter</filter-class>
 </filter>
 <filter-mapping> 
   <filter-name>nocachefilter</filter-name>
   <url-pattern>/logout</url-pattern> 
</filter-mapping> 
<servlet-mapping>
    <servlet-name>logout</servlet-name>
    <url-pattern>/logout</url-pattern>
</servlet-mapping>

Could anyone help me?Thanks!

Answer 1

The problem is that when you hit the back button, the page is loaded from the cache and not the browser. You can use the solution provided from this answer to avoid loading from the cache:

Prevent user from seeing previously visited secured page after logout

Your servlet and filter should be two different classes. In your case, you are using the same class as a Servlet and as Filter.

  <servlet-class>user.LogOut</servlet-class>
  <filter-class>user.LogOut</filter-class>

Create a Servlet class..and the cookie logic to that class.

   public class LogOutServlet extends HttpServlet{

        protected void doPost(HttpServletRequest req,
             HttpServletResponse response1) throws ServletException, IOException {
               Cookie[] cookies = req.getCookies();
              if (cookies != null) {
              for (Cookie cookie : cookies) {
                     if(cookie.getName().equals(req.getSession().getAttribute("email"))) {
                     System.out.println(req.getSession().getAttribute("email")
                        + cookie.getValue());
            }
            cookie.setMaxAge(0);
            response1.addCookie(cookie);
         }
    }
}

And your web.xml as : You have to specify the filter-mapping and servlet-mapping elements for each filter and servlet respectively. In you file, servlet-mapping was missing for logout servlet and filter-mapping was missing for filter.

 <servlet>
    <servlet-name>logout</servlet-name>
    <servlet-class>user.LogOut</servlet-class>
 </servlet>
 <filter>
    <filter-name>nocachefilter</filter-name>
    <filter-class>user.NoCacheFilter</filter-class>
 </filter>
 <filter-mapping> 
   <filter-name>nocachefilter</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping> 
<servlet-mapping>
    <servlet-name>logout</servlet-name>
    <url-pattern>/logout</url-pattern>
</servlet-mapping>