title: Spring Security Logout Back Button
body: <p>Does spring security have a way to prevent the last point below?  I'm using 3.0.5</p>
  
  <p>-user logs into my website
  -user goes to any page in website and clicks log out
  -log out link invalidates user session and sends them to the login page in my website
  -in same browser, user navigates to new website (say cnn.com)
  -user hits back button and they land at my login page
  -user hits back button again and they end up at the page within the application that may have data that we dont want to be there.  If they click any link on the page they immediately get sent to login page, but they can view the cached page from the browser cache...any way to not let them view this?</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans
      xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:util="http://www.springframework.org/schema/util"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
      http://www.springframework.org/schema/util
      http://www.springframework.org/schema/util/spring-util-3.0.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-3.0.xsd
      http://www.springframework.org/schema/context
      http://www.springframework.org/schema/context/spring-context-3.0.xsd"&gt;
      &lt;context:annotation-config /&gt;
      &lt;context:component-scan base-package="dc" /&gt;
      &lt;global-method-security /&gt;
      &lt;http access-denied-page="/auth/denied.html"&gt;
           &lt;intercept-url filters="none" pattern="/javax.faces.resource/**" /&gt;
           &lt;intercept-url filters="none" pattern="/services/rest-api/1.0/**" /&gt;
           &lt;intercept-url filters="none" pattern="/preregistered/*"/&gt;
           &lt;intercept-url
              pattern="/**/*.xhtml"
              access="ROLE_NONE_GETS_ACCESS" /&gt;
           &lt;intercept-url
              pattern="/auth/*"
              access="ROLE_ANONYMOUS,ROLE_USER"/&gt;
           &lt;intercept-url
              pattern="/preregistered/*"
              access="ROLE_ANONYMOUS,ROLE_USER"/&gt;
           &lt;intercept-url
              pattern="/registered/*"
              access="ROLE_USER"
              requires-channel="http"/&gt;
          &lt;form-login
              login-processing-url="/j_spring_security_check.html"
              login-page="/auth/login.html"
              default-target-url="/registered/home.html"
              authentication-failure-url="/auth/login.html" /&gt;
           &lt;logout invalidate-session="true" 
                logout-url="/auth/logout.html" 
                success-handler-ref="DCLogoutSuccessHandler"/&gt;
          &lt;anonymous username="guest" granted-authority="ROLE_ANONYMOUS"/&gt;
          &lt;custom-filter after="FORM_LOGIN_FILTER" ref="xmlAuthenticationFilter" /&gt;
          &lt;session-management session-fixation-protection="none"/&gt;
      &lt;/http&gt;
      &lt;!-- Configure the authentication provider --&gt;
      &lt;authentication-manager alias="am"&gt;
          &lt;authentication-provider user-service-ref="userManager"&gt;
                  &lt;password-encoder ref="passwordEncoder" /&gt;
          &lt;/authentication-provider&gt;
          &lt;authentication-provider ref="xmlAuthenticationProvider" /&gt;
      &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;
  </code></pre>