Question

I have a problem with my Java EE (Tomcat) java based web application.

• user logs in to website
• user viewing page a ssl page in our web site
• user logs off, session invalidated
• user gets redirected to login page (ssl)
• user hits the back button and is able to get to the page in step 2.

How is this avoidable?

Answer 1

Set the Cache-Control header on those pages to

no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0

(also Expires, Last-Modified, Pragma)

see this question for how to do it