If you do session.invalidate() and press the back button on your browser, it isn't that the session isn't invalidated, it is that the browser has a cache of that page in local memory. If you don't want that you have to turn caheing off. Do a google search for JSP No Cache and you should get a good article from JGuru on it.
If you want to stop users to see previous page do this:
<script language="JavaScript" type="text/JavaScript">
javascript:window.history.forward(1);;
</script>
Put this script in page and when user press back button he will unable
to se previous page.
If you want to make your session invalid then you use session.invalidate() or you can make logout.jsp page and put this code:
<% session.removeAttribute("username");
session.invalidate();
response.sendRedirect("index.jsp");
%>
This will remove Attribute username (this is for example name of user who has been logged), make that session invalid and redirect you to first page of your appliaction.
Hope this will help