title: How to properly invalidate JSP session?
body: <p>So here is the problem. When a user logs out of my website, they can still hit the back button and continue using the site. To keep track of whether the user is logged in or not, I created a session attribute "isActive". The attribute is set to true when the user logs in, and is (redundantly) removed right before the session is invalidated at logout. Also on every page I check if the attribute is present.</p>
  
  <p>I also specify that pages should not be cached in their head tags.</p>
  
  <p>Despite this users are still able to hit back on the browser, and continue to use the site as if they never logged off.</p>
  
  <p>Any idea on how to fix this?</p>
  
  <p>Here is the code:</p>
  
  <p><strong>Login Servlet:</strong></p>
  
  <pre><code>...
  session.setAttribute("isActive", true);
  //Redirect to home page.
  </code></pre>
  
  <p><strong>Check Logged In JSP:</strong></p>
  
  <pre><code>&lt;c:if test='${empty sessionScope.isActive || sessionScope.isActive != true}'&gt;
       &lt;c:redirect url="/index.jsp?message=Session Timed Out."/&gt;
  &lt;/c:if&gt;
  </code></pre>
  
  <p><strong>Logout Servlet:</strong></p>
  
  <pre><code>request.getSession().removeAttribute("isActive");
  request.getSession().invalidate();
  response.sendRedirect("index.jsp");
  </code></pre>
  
  <p><strong>Inside Head Tag:</strong></p>
  
  <pre><code>&lt;meta http-equiv="Pragma" content="no-cache"&gt;
  &lt;meta http-equiv="Cache-Control" content="no-cache"&gt;
  &lt;meta http-equiv="Expires" content="Sat, 01 Dec 2001 00:00:00 GMT"&gt;
  </code></pre>
  
  <p>Thanks</p>