help me ...

Thread view:

sree - 13 May 2004 07:39 GMT

We've a site which on entry prompts for the user authentication.
the user info is taken from the LDAP server and not from database.
what's happening with our system is ---on the user logout it's showing
the logout msg but
1) when clicked on the back button of the browser
or
2) by selecting the home page url

it's taking the user back to already visited pages of the site instead of
prompting for authentication as the user is already logged out.

the problem i think arising due to browser cache...which is keeping user details
in it n getting refreshed on logout.
but in logout.jsp session is being invalidated using

session.invalidate() method

i tried the follwing statements after invalidating the session

response.setHeader("Cache-control","private,no-cache");
response.setHeader("Expires","-10000000");
response.setHeader("pragma","no-cache");

but of no use...................
is it happenening bcoz the user data is stored on LDAP..?

what is the cause for this behavior?
plz can any one send me the code to me....

regards

D.Sreenivas

Reply to this Message

FISH - 13 May 2004 12:37 GMT

> We've a site which on entry prompts for the user authentication.
> the user info is taken from the LDAP server and not from database.
[quoted text clipped - 6 lines]
> it's taking the user back to already visited pages of the site instead of
> prompting for authentication as the user is already logged out.

[snipped...]

> but of no use...................
> is it happenening bcoz the user data is stored on LDAP..?

[snipped...]

Unlikely, although consulting your server logs will tell you if the
browser is fetching data after its authentification has expired, or
whether it is the browser cache. My money is on a cache, either the
browser's own cache, or a proxy between the client and server. ;-)

There are a number of ways of trying to solve a cache problem,
including making the page look like a CGI (using post or adding a
? to the end of the URL to fake a get method query) which many
cache's will not retain. Also adding no-cache etc. headers. And
using a cookie to stop back-tracking. But it sounds as if you
have tried all of those already.

-FISH- ><

Reply to this Message

Chris Smith - 14 May 2004 17:24 GMT

> There are a number of ways of trying to solve a cache problem,
> including making the page look like a CGI (using post or adding a
> ? to the end of the URL to fake a get method query) which many
> cache's will not retain. Also adding no-cache etc. headers. And
> using a cookie to stop back-tracking. But it sounds as if you
> have tried all of those already.

THE way to solve this is to add a "Cache-control: no-cache" header for
HTTP 1.1 clients. Such clients are then non-conformant if they cache
the pages. For older HTTP 1.0 clients, there is no such simple answer,
though a "Pragma: no-cache" and "Expires: -1" may help.

Signature

www.designacourse.com
The Easiest Way to Train Anyone... Anywhere.

Chris Smith - Lead Software Developer/Technical Trainer
MindIQ Corporation

Reply to this Message

help me ...

Free Magazines