title: Page not secured after log out and click back button
body: <p>In my previous employment I was experiencing a well known problem of being unable to prevent the user from being able to navigate the site using the back button after logging out. My technologies include Spring, JavaScript and potentially the Mobile module of the Java AJAX library ZK. Besides navigating using the back button, authorised access worked otherwise. I no longer have access to the application code. The application was a mobile one of which I was not the original author.</p>
  
  <p>I've tried the following common solutions:</p>
  
  <ul>
  <li>Have tried adding a <code>WebContentInterceptor</code> (as instructed <a href="https://stackoverflow.com/questions/4364622/how-to-set-header-no-cache-in-spring-mvc-3-by-annotation">here</a> )</li>
  <li>Defined my own filter using a combination of <a href="https://stackoverflow.com/questions/4194207/prevent-user-from-going-back-to-the-previous-secured-page-after-logout">this filter question</a> and this answer <a href="https://stackoverflow.com/questions/11928637/how-to-write-a-custom-filter-in-spring-security">about inserting additional filters</a>. Filter code is not executed during debug</li>
  <li>Added <code>RequestMappingHandlerAdapter</code> to set <code>cacheSeconds</code> to 0</li>
  </ul>
  
  <p><br>We have the following definition in <code>t2-spring-security-context.xml</code>:</p>
  
  <pre><code>&lt;http auto-config="true"&gt;
      &lt;intercept-url pattern="/mobile-index*" access="ROLE_ADMIN"/&gt;
      &lt;intercept-url pattern="/t2-metrics*" access="ROLE_ADMIN"/&gt;
      &lt;intercept-url pattern="/t2-monitor*" access="ROLE_ADMIN"/&gt;
      &lt;form-login login-page="/login.jsp" authentication-failure-url="/loginerror.jsp"
                  default-target-url="/mobile-index.jsp"/&gt;
      &lt;logout logout-success-url="/login.jsp" invalidate-session="true"/&gt;
  
  &lt;/http&gt;
  </code></pre>
  
  <p><br>Other details about our implementation:</p>
  
  <ul>
  <li>Java methods are called using <code>@RequestMapping</code> from JavaScript on a class annotated as <code>@Controller</code> (I.E. t2-metrics.jsp has JS to fire to URL matching request mapping)</li>
  <li>Tried adding <code>security:global-method-security</code> to application context and role annotation to method </li>
  <li>Have scriptlet code to disable caching to the JSP pages and that did nothing. Also, fired up the application in debug within IntelliJ and a debug point within my define filter is not hit. </li>
  <li>Once they have used the back button to return into the application the user can still navigate around the application.</li>
  </ul>
  
  <p>My only remaining idea was that the problem involves our client code (JavaScript) or libraries (Incorrect integration with Spring Security) for from the view because debug did not hitting the Spring Security filter chain.</p>