Kill session and redirect to login page on click of logout button

Question

I have the following code in JSP:

<%
    if(session.getAttribute("Username") == null || session.getAttribute("Username") == "_INVALID_")
    {
        response.sendRedirect("LoginPage.html");
    }
%>

<form>
    <input type="button" value="Change Account Details" onClick="location.href='ChangeDetails.jsp'">
    <br></br>
    <input type="button" value="Add Customers" onClick="location.href='AddCustomers.jsp'">
    <br></br>
    <input type="button" value="Manage Flights" onClick="location.href='ManageFlights.jsp'">
    <br></br>
    <input type="button" value="Book Flights" onClick="location.href='BookFlights.jsp'">
    <br></br>
    <input type="button" value="Log Out" onClick="location.href='LoginPage.html'">
</form>

When the user clicks on the log out button, I want to redirect him to the log-in page and kill the current session. I have succeeded in the redirection part but I do not know how to kill the session. How can this be done please?

Tried using `session.invalidate()`? Also, using a google search on this topic will get you so many nice solution regarding this. Because just `invalidating` the session is not enough. You also need to set some `cache-headers` (I don't really rememeber which ones exactly), to avoid user to use back button to come back to the last page even after logout. — Rohit Jain, Dec 04 '12 at 16:20
possible duplicate of [Prevent user from going back to the previous secured page after logout](http://stackoverflow.com/questions/4194207/prevent-user-from-going-back-to-the-previous-secured-page-after-logout) — Rohit Jain, Dec 04 '12 at 16:26

score 22 · Accepted Answer · edited May 23 '17 at 11:54

In order to kill the current session, you basically need to call HttpSession#invalidate() and perform a redirect to the login or main page. This code is supposed to be placed in doPost() method of a servlet which is invoked by a POST request.

E.g.

<form action="${pageContext.request.contextPath}/logout" method="post">
    <input type="submit" value="Logout" />
</form>

with

@WebServlet("/logout")
public class LogoutServlet extends HttpServlet {

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        request.getSession().invalidate();
        response.sendRedirect(request.getContextPath() + "/LoginPage.html");
    }

}

Unrelated to the concrete problem, your username checking code is not at the right place. You shouldn't be copypasting the same code over every single JSP page. You should be performing this job in a single place in a servlet filter. Java code in JSP files should be avoided as much as possible.

Further, there's another potential problem when the enduser uses the browser's back button to navigate back in history. By default, the browser will cache all responses and thus the back button might display the page from the browser cache instead of requesting a brand new straight from the server. In order to fix this, see this related question Prevent user from seeing previously visited secured page after logout

Last but not least, you've there some quite strange HTML. Buttons with onClick to navigate? How user and SEO unfriendly. Use normal <a> links instead. For the button look'n'feel, throw in some CSS.

score 2 · Answer 2 · edited May 23 '17 at 12:26

2

You should take a look at the invalidate() method of HttpSession. The session can be retrieved via HttpServletRequest getSession() method.

You should also take a look at Expires, Cache-Control, Pragma http headers, as in: Prevent user from going back to the previous secured page after logout .

edited May 23 '17 at 12:26

Community

1
1

answered Dec 04 '12 at 16:23

rvcoutinho

326
1
10

score 0 · Answer 3 · answered Jul 22 '14 at 09:58

0

try this to kill session

HttpSession newsession = request.getSession(false);
    if (newsession != null) 
    {
         newsession.invalidate();

    }

   response.sendRedirect("../index.jsp");

answered Jul 22 '14 at 09:58

Prikshit

304
2
12

Kill session and redirect to login page on click of logout button

3 Answers3

Linked