我有一个servlet和一个HTML页面。如何在注销后阻止用户点击浏览器的后退按钮?我在stackoverflow中读过相同的问题,但答案是使用浏览器历史记录禁用java脚本或使用页面 - 在http标头中没有缓存。我们如何使用阻止返回操作的servlet来实现它,http-header没有缓存是无用的,因为Firefox表示当页面再次刷新两次时页面已过期显示安全页面。
我做过某种方式,样本方法只是为了尝试(不是真的) 如果密码和用户名正确,我的用户名和密码将从HTML页面发布到servlet,servlet将其存储在会话中。 再次请求安全页面时,如果会话存在,则会显示安全页面,并且用户从登录页面显示的会话中注销所有内容都正常工作,但如果用户点击浏览器的按钮,则退出失败。
如何阻止安全servlet在注销后显示内容,然后在浏览器中按下后退按钮?
welcome.html
的src<html>
<body>
<form method="POST" action="Sessionexample">
<div align="center">
<table border="1" style="border-collapse: collapse">
<tr>
<td>Username</td>
<td><input type="text" name="username" size="20"></td>
</tr>
<tr>
<td>Password</td>
<td><input type="text" name="password" size="20"></td>
</tr>
<tr>
<td height="24"> </td>
<td height="24"> </td>
</tr>
<tr>
<td> </td>
<td><input type="submit" value="Submit" name="B1"></td>
</tr>
</table>
</div>
</form>
</body>
</html>
servlet的src
public class Sessionexample extends HttpServlet implements Servlet , Filter {
private static final long serialVersionUID = 1L;
public String username =null, password=null;
public HttpSession session ;
public PrintWriter pw;
int do_get =0 ;
/**
* Default constructor.
*/
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
HttpSession session = request.getSession(false);
if (session == null || session.getAttribute("username") == null) {
response.sendRedirect("welcome.html"); // No logged-in user found, so redirect to login page.
response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
response.setHeader("Pragma", "no-cache"); // HTTP 1.0.
response.setDateHeader("Expires", 0);
} else {
chain.doFilter(req, res);
}
}
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
{
do_get=1;
pw = response.getWriter();
session=request.getSession(false);
try
{
if(request.getParameter("action")!=null)
{
if(request.getParameter("action").equals("logout"))
{
session = request.getSession(true);
session.setAttribute("username", "");
session.setAttribute("password", "");
session.invalidate();
response.sendRedirect("welcome.html");
return;
}
}
else
if(session !=null)
{
if( (String)session.getAttribute(username)!=null)
username = (String)session.getAttribute("username").toString();
if( (String)session.getAttribute("password") !=null)
password =session.getAttribute("password").toString();
pw.write("not new-");
serviced(request,response);
}
}
catch(Exception ex)
{
pw.write("Error-"+ex.getMessage());
}
}
/**
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
*/
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
{
if(request.getParameter("username")!=null && request.getParameter("password")!=null )
{
username = request.getParameter("username").toString();
password = request.getParameter("password").toString();
}
serviced(request,response);
}
protected void serviced(HttpServletRequest request, HttpServletResponse response) throws IOException
{
response.setContentType("text/html");
pw = response.getWriter();
if( username !=null && password !=null)
if( username.equals("admin") && password.equals("a"))
{
try
{
if(do_get==0)
{
session = request.getSession(true);
session.setAttribute("username", "admin");
session.setAttribute("password", "a");
}
pw.write("You are logged in : "+username+" <br/> "+"<a href='?action=logout'><h1> Logout </h1> </a>");
}
catch(Exception ex)
{
response.sendRedirect("welcome.html");
}
}
else
{
response.sendRedirect("welcome.html");
}
else
response.sendRedirect("welcome.html");
}
@Override
public boolean accept(Object arg0) throws IOException {
// TODO Auto-generated method stub
return false;
}
}
答案 0 :(得分:11)
您的过滤器仅在welcome.html
上设置无缓存标头,而不是在受限制的页面上设置。因此,只要浏览器通过后退按钮请求任何受限制的页面,它就可能显示缓存版本。您的过滤器需要在所有受限制的页面上设置无缓存标头。
所以,你需要改变
if (session == null || session.getAttribute("username") == null) {
response.sendRedirect("welcome.html"); // No logged-in user found, so redirect to login page.
response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
response.setHeader("Pragma", "no-cache"); // HTTP 1.0.
response.setDateHeader("Expires", 0);
} else {
chain.doFilter(req, res);
}
到
if (session == null || session.getAttribute("username") == null) {
response.sendRedirect("welcome.html"); // No logged-in user found, so redirect to login page.
} else {
response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
response.setHeader("Pragma", "no-cache"); // HTTP 1.0.
response.setDateHeader("Expires", 0);
chain.doFilter(req, res);
}