Session management with Back and Forward buttons from browser.

It doesn't, its utter nonsense.

The fact is that you have no control over what the user does in the browser: you cannot disable any buttons, you cannot force the user to do anything, he or she is in total control and that's only a good thing. The only thing you can do is make sure that your webapp doesn't blow up when he does such things.

For example: there is the refresh button. When the user presses it, and be sure that he/she/it will do that regularly, the last request sent will be sent again. If that last request included some kind of database manipulation, that will also be performed again, something you absolutely do not want.

So what you can do is after doing such a transaction, perform a redirect to the results page in stead of displaying the results in the same request. Then when the user presses the refresh button the redirect will be performed again, not the database transaction.

The same goes for the back button: when the user presses it he/she will go back to the redirect and instantly be kicked back (if this is what you want depends on the application: it is very unfriendly to the user when this happens).

I hope that gives you some idea about your role in the whole web application environment: you are not the boss.

gimbal2a at 2007-7-14 18:04:51 >

A forward happens on the server side, this will NOT do what I suggested. I'm talking about a redirect, which is done by the browser. The browser cannot and will never know that a forward happened.

There are multiple ways to do a redirect, one is to output a simple HTML page that does it (with either javascript or a meta refresh), or you could use the jsp:redirect tag element.

Check out point 4 on this page:

http://www.oreillynet.com/pub/a/oreilly/java/news/jsptips_1100.html

gimbal2a at 2007-7-14 18:04:51 >