| Summary: | Properly handling the logout process in a password-protected Web application requires more than just calling the invalidate() method on the HttpSession object because most modern browsers, with the Back and Forward buttons, allow users to go back or forward on a page. If the Back button causes the browsers to display stale pages from their caches after the logout process, users of these inadequately-developed applications can become confused, lost, and wonder what has or could have happened to their personal data. Many Web applications put up a page threatening users to close their browsers completely, thus, in effect, preventing them from clicking the Back button. Others use JavaScript, which is not always active on clients' browsers. Most of these solutions are either awkwardly implemented, fail to work 100 percent of the time under all circumstances, require too much training on behalf of users, and/or compromise the user experience. This article presents solutions for properly handling the logout problem along with sample programs. Author Kevin Le starts by describing an ideal password-protected Web application. He then uses sample programs to illustrate how the problems manifest themselves and discusses the solutions required to fix the problems. By centering the discussion on JavaServer Pages (JSP), the article presents the concepts that can be easily understood and adopted for other Web-tier technologies. Le concludes his discussion by showing how building Web applications with Jakarta Struts can more elegantly solve the logout problem. Sample programs for both JSP and Struts Web applications are included. (3,700 words; September 27, 2004)
|
