Prevent the browser from exiting after the Web application is logged out

Normally, the browser caches the page. In this case, you can access the page you just logged out. For example, you can access the page you just cached after logging out of the Web application, in some cases, this is not safe enough. The solution to the problem is as follows:

response.setHeader("Cache-Control","no-cache"); response.setHeader("Cache-Control","no-store"); response.setDateHeader("Expires", 0); response.setHeader("Pragma","no-cache"); 

First, add the above four lines of code to JSP or Struts action. I personally add them to action. Adding a framework for processing exit problems for a Struts-based Web application can be elegantly implemented without any effort. This is partly because Struts adopts the MVC design pattern, so the model and view are clearly separated. In addition, Java is an object-oriented language that supports inheritance and is easier to reuse code than JSP scripts.

By using the class inheritance mechanism, other classes can inherit the general logic in the basic class BaseAction to set HTTP header information and retrieve the username string in the HttpSession object. This basic class is an abstract class and defines an abstract method executeAction (). All subclasses that inherit from the base class should implement the exectuteAction () method instead of overwriting it. Some code of the base class below:

  "Cache-Control","no-cache""Cache-Control","no-store""Expires", 0"Pragma","no-cache"

When logging out of the system, pay attention to clearing the place where the user certificate is saved. I am in session. To log out, do the following:

=="User");     "logout"

Configure an interceptor to prevent logged-out users from going back to the system:

  LoginSessionFilter   ===== (User) req.getSession().getAttribute("User "         (servletPath.contains("login.action"             (user == + " login.action"  init(FilterConfig arg0) 

After the above encoding is completed, the 99% problem can be solved. However, when the browser clicks back and corresponds to the logged-on action, this action performs user name and password authentication, after the user name and password are submitted back, the user will log on to the system and fail to be blocked. Therefore, we can make a time to verify whether the request is a normal login request:

LoginAction String userName; String password; logonTime; lastLogonTime; (logonTime> = "Logon page """

Conclusion

This article describes the solution to the exit problem. Although the solution is simple and surprising, it works effectively in all circumstances. For JSP and Struts, all you need to do is write a code of up to 50 lines and a method to record the user's last logon time. Hybrid use of these solutions in Web applications can prevent the leakage of private data and increase user experience.