title: Spring Security browser back button issue in IE and Firefox but not in Chrome
body: <p>I am using spring security 4.1.1 along with spring 4.3.4 and Thymeleaf 3.x after logout when I click on browser back button in chrome browser its still in login page but in IE and Firefox due to caching its redirecting to the page from where I clicked on logout. In redirected page if I click on any button or link its directing to login page meaning it is issue with cache and in Firefox I can see that as BFCache</p>
  
  <p>Here is my securityConfiguration file</p>
  
  <pre><code> @Override
      protected void configure(HttpSecurity httpSecurity) throws Exception {
  
          RequestMatcher matcher = new AntPathRequestMatcher("/login");
          DelegatingRequestMatcherHeaderWriter headerWriter =
              new DelegatingRequestMatcherHeaderWriter(matcher,new XFrameOptionsHeaderWriter());
  
          //to disable loading application back button after logout
          httpSecurity
              .headers()
                  .defaultsDisabled()
                      .cacheControl().and()
                  .contentTypeOptions().and().addHeaderWriter(headerWriter)
                  .httpStrictTransportSecurity()
                      .includeSubDomains(true)
                      .maxAgeInSeconds(31536000).and()
                  .frameOptions().sameOrigin().xssProtection().block(false);
  
  
          httpSecurity
              /*.csrf()
                  .disable()*/
              .authorizeRequests()
                  .expressionHandler(webExpressionHandler())
                  .antMatchers("/forgotPwd", "/resetPwd*", "/successRegister*",
                          "/registrationConfirm*", "/registration.html", "/user/registration")
                  .permitAll()
                  // .antMatchers(HttpMethod.POST,"/api","/api/**").hasRole("ROLE_ADMIN")
                  .anyRequest().fullyAuthenticated()
                  .and()
              .formLogin()
                  .loginPage("/login.html")
                  .defaultSuccessUrl("/home.html")
                  .usernameParameter("username")
                  .passwordParameter("password")
                  .failureUrl("/login.html?error=true")
                  // .successHandler(myAuthenticationSuccessHandler)
                  .failureHandler(authenticationFailureHandler)
                  .permitAll()
                  .and()
              .sessionManagement()
                  .invalidSessionUrl("/invalidSession.html")
                  .sessionFixation().none()
                  .and()
              .logout()
                  .invalidateHttpSession(true)
                  .deleteCookies("remember-me", "SESSION")
                  .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                  .logoutUrl("/logout")
                  .logoutSuccessUrl("/login.html")
                  .permitAll()
                  .and()
              .rememberMe()
                  .rememberMeServices(rememberMeServices())
                  .tokenValiditySeconds(86400)
                  .rememberMeCookieName("remember-me")
                  .and()
              .exceptionHandling().accessDeniedPage("/403");
      }
  </code></pre>
  
  <p>How to make IE and Firefox disable the Cache?</p>
  
  <p>How to disable this?</p>
  
  <p>For full working application code check my <a href="https://github.com/rajadileepkolli/springsecuredthymeleafapp" rel="nofollow noreferrer">github</a></p>