如何解决Spring MVC项目中登出后浏览器返回按钮的安全问题？

Recently, I was working on a web app built with Spring MVC, Hibernate, and JSP, and hit a frustrating security problem: after a user logged out, clicking the browser's back button would still load the secured pages they'd accessed earlier. This was a big red flag for user data safety.

I started by searching online and asking senior devs for help. The go-to solution everyone suggested was setting no-cache, no-store, and related response headers on secured pages. But this approach had a major flaw—when users clicked back after logging out, Chrome would throw an error, and they had to refresh twice before being redirected to the login page. Terrible user experience, not something we could ship.

Then yesterday, while I was fixing a form duplicate submission bug, I stumbled across a combination of fixes that solved the logout back button issue perfectly. Here's what worked for me:

Step 1: Properly Invalidate Session and Clear Cookies on Logout #

First, make sure your logout endpoint fully cleans up the user's session and any authentication cookies:

@RequestMapping(value = "/logout", method = RequestMethod.GET)
public String logout(HttpServletRequest request, HttpServletResponse response) {
    // Invalidate the session if it exists
    HttpSession session = request.getSession(false);
    if (session != null) {
        session.invalidate();
    }

    // Clear any auth-related cookies (adjust cookie names to match your app)
    Cookie[] cookies = request.getCookies();
    if (cookies != null) {
        for (Cookie cookie : cookies) {
            if ("JSESSIONID".equals(cookie.getName()) || "USER_AUTH".equals(cookie.getName())) {
                cookie.setMaxAge(0);
                cookie.setValue("");
                cookie.setPath("/");
                response.addCookie(cookie);
            }
        }
    }

    return "redirect:/login";
}

Step 2: Add a Cache-Control Interceptor for Secured Pages #

Instead of setting headers manually on every controller method, use a Spring interceptor to apply cache-control rules only to your secured routes. This avoids header conflicts and keeps code clean:

public class CacheControlInterceptor implements HandlerInterceptor {
    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        // Apply headers only to pages under your secured path (adjust as needed)
        if (modelAndView != null && request.getRequestURI().startsWith("/dashboard/")) {
            response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
            response.setHeader("Pragma", "no-cache");
            response.setDateHeader("Expires", 0);
        }
    }
}

Register the interceptor in your Spring config:

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new CacheControlInterceptor());
    }
}

Step 3: Frontend Session Validation on Page Load #

Even with backend headers, some browsers might still cache the page content. Add a small script to your secured JSP pages that checks if the user's session is still valid when the page loads:

<script>
    window.addEventListener('load', function() {
        fetch('/api/check-session')
            .then(res => {
                if (!res.ok) {
                    window.location.href = '/login';
                }
            })
            .catch(() => {
                // If the request fails, assume session is invalid
                window.location.href = '/login';
            });
    });
</script>

Create the corresponding endpoint to validate the session:

@RequestMapping(value = "/api/check-session", method = RequestMethod.GET)
public ResponseEntity<Void> checkUserSession(HttpServletRequest request) {
    HttpSession session = request.getSession(false);
    // Replace "loggedInUser" with your session attribute name
    if (session == null || session.getAttribute("loggedInUser") == null) {
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
    }
    return ResponseEntity.ok().build();
}

Final Result #

Combining these three steps fixed the issue entirely: after logging out, clicking the browser back button immediately redirects users to the login page—no errors, no double refreshes, and no exposed secured content.

I've also put together a minimal demo project that implements all these steps in a basic Spring MVC + Hibernate + JSP setup. You can download it to test the solution directly in your local environment.

内容的提问来源于stack exchange，提问作者Shafqat Shafi