Thanks,

The problem is that I'm getting the problem in the page which is 
immediately after the user logs in...so regardless there should be no 
attributes when the user logs in...and when the session is invalidated the 
objects that are bound to it are all lost.

I might need to figure out a way around this, or some other way. The 
cookies are good but I can't use it if the cookies in the browser are 
disabled.

Thanks


> I detest the browser's "Back" and "Refresh" buttons; somebody needs to 
write
a book and tell us how to program around these terrible headaches! They
cause me nothing but trouble!

I am not exactly sure what is going on in your program, but it does sound
very strange. Why not do something like this:  when the user logs in, store
some value as a session attribute. When you invalidate the session, that
attribute will be removed. Then, you can check for the presence of this
session attribute/value and, if its not there, then the user is considered
to be "logged off".

-----Original Message-----
From: Abhijeet Kenjale [mailto:akenjale@f...]
Sent: Thursday, October 10, 2002 6:04 PM
To: Pro_JavaServer_Pages
Subject: [pro_jsp] Re: HELP - Session.invalidate() problems


Hi,

I guess u can use Cookies to solve this problem. I have done the same thing
in my project.

When user logs in ur system, set Cookie of that user and reset that Cookie
in 'Logout' JSP.

In your each JSP check for value of Cookie using JavaScript, if there is no
value then redirect user to 'Login' page. So if user logs out and come 
back,
at that point only JavaScript code will check for Cookie and it will open
Login page if there is no value for Cookie.

This should work.

~Abhijeet

----- Original Message -----
From: "Lior Shliechkorn" <lior@f...>
To: "Pro_JavaServer_Pages" <pro_jsp@p...>
Sent: Thursday, October 10, 2002 9:36 PM
Subject: [pro_jsp] HELP - Session.invalidate() problems


> I'm trying to end a session and when I hit the BACK button after I log 
the
> user out and then hit refresh, the user is logged in again.
>
> I have the session starting like this:
> 1. They log in USER / PASS
> 2. They're taken to jsp page that directs them to the appropriate 
location
>    using the JSP forward.
> 3. When they log out they're taken to a log out page and the session is
>    then invalidated and they are forwarded to an HTML page to log on
again.
>
> Now I put repose.setHeaders for disabling caching of JSP output so when
> the back button is hit I get a "Page expired" message and hit refresh and
> they're logged in again as if they didn't go to the logout page.
>
> I'm so confused by this. I don't understand how to make it work. And I
> check if the page is still reading the original form data and it is. Even
> though I forwarded to another page, logged out, and then
> response.sendRedirect to another page. I can't check for session beans
> because initally at the login page where they are taken after they fill
> the user/pass form all values are initially null anyway...so it recreates
> the beans and everything.
>
> Stumped...please help.
>
> Thanks
> ---
> Change your mail options at http://p2p.wrox.com/manager.asp or
> to unsubscribe send a blank email to 


---
Change your mail options at http://p2p.wrox.com/manager.asp or 
to unsubscribe send a blank email to 



----------  Internet E-mail Confidentiality Disclaimer  ----------

PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message.  If
you are not the addressee indicated in this message or the employee or 
agent
responsible for delivering it to the addressee, you are hereby on notice
that you are in possession of confidential and privileged information.  Any
dissemination, distribution, or copying of this e-mail is strictly
prohibited.  In such case, you should destroy this message and kindly 
notify
the sender by reply e-mail.  Please advise immediately if you or your
employer do not consent to Internet email for messages of this kind.

Opinions, conclusions, and other information in this message that do not
relate to the official business of my firm shall be understood as neither
given nor endorsed by it.