Disabling page access via cached URL or back button after logging out(Servlets)

Question

Requirement:

I am implementing secure logout feature in my web app(Servlets-JSP based) i.e after logging out user shouldn't be able to access any pages by typing url from Cache or hitting the back button on browser,Application should redirect to login page.

What I did:

Based on some reading and some SO answers i started implementing this feature with Filters and this is what i did.

in web.xml

<filter>
    <filter-name>NoCacheFilter</filter-name>
    <filter-class>com.controller.NoCacheFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>NoCacheFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

in my Filter class doFilter() method

public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException {
     HttpServletResponse response = (HttpServletResponse) servletResponse;
     HttpServletRequest request=(HttpServletRequest) servletRequest;

     response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); 
     response.setHeader("Pragma", "no-cache");
     response.setDateHeader("Expires", 0); 

     HttpSession session=request.getSession(false);

     if(session != null && !session.isNew()) {
            chain.doFilter(request, response);
        } 
     else {
            response.sendRedirect("/WEB-INF/login.jsp");
        }

}

I am using chrome,the feature is not working at all,i.e user can still access pages after logging out with URL typing or hitting back button.

Where i am doing wrong? what changes should be done to make it work.

Thanks in advance,

I tried to debug using logger,the flow is never hitting the filter's doFilter method. — , Apr 24 '17 at 12:36
Post full code for your filter class?Are you extending javax.servlet.Filter — Shivam Aggarwal, Apr 24 '17 at 12:41
You are missing chain.doFilter(servletRequest,servletResponse); at the end of filter doFilter method — Shivam Aggarwal, Apr 24 '17 at 12:43
yes i extended javax.servlet.filter. i did chain.doFilter(request,response) inside "if" clause. — , Apr 24 '17 at 13:03
I added filter as "/*" means it should be filtering every url right? i am not getting logging message from doFilter() not even once — , Apr 24 '17 at 13:12
please use chain.doFilter(request,response) in filter method.Refer this http://stackoverflow.com/questions/4122870/what-is-the-use-of-filter-and-chain-in-servlet — Shivam Aggarwal, Apr 25 '17 at 04:59
I did chain.doFilter(request,response) inside if clause,should i change it's position? — , Apr 25 '17 at 09:44
Needs to be the last statement,not within any conditional block!! — Shivam Aggarwal, Apr 25 '17 at 09:54

Disabling page access via cached URL or back button after logging out(Servlets)

0 Answers0