Hello,
I am using the Tomcat Formed-Authentication. Now, I know that the login page will pop-up only once per browser session. When the user exits the application, I want that the next time he enters, the login page pops-up
again. To do this, I suppose I have to close the browser application when
he exits the application.
Any idea of how to do it?
Thanks
ELisabeth

If it doesn't it means the session has not expired yet (default: 30min). 2 solutions: make the exp timeframe shorter, or better if u can signal the server on main wnd browse closed (u can use onBeforeUnload on same base object like the base frameset or body which the case may be, or window? try it out) and than session.invalidate() if i recall the syntax, anyway, you can find it. One more thing: if the user is already authenticated and resumes "attacks" after that short while isn't ok to skip the login and get to business? only if it doesn't confuse him i guess..:)

-------------
Nicu Marasoiu
java programmer

dear elisabeth,
I understood ur problem like this,
When the user exits the application, i.e when he logs out of the application, u want the session to be invalidated right?..
If that is the case, you call session.invalidate(). against the logout click.

Or if you want the session to be invalidated and fresh login to be popped up, when the user exits out of the application without a logout request, i.e if he closes the browser and reopens it, better use a client side script to call a jsp/servlet to invalidate the session. There are certain event handlers that can be invoked before closing thewindow. events like onUnload(), onClose() will work out. Try for the syntax of these events... sorry for not providing the syntax..

regards
Rammohan
J2EE Programmer.