play framework won't logout with secure module

Question

I have a problem when I do logout. Basically I am using the secure module, i call to the method secure.logout(), this redirect to login page, but i can do back and come back to the page, as if I am logued.

public static void logout() throws Throwable {
    Security.invoke("onDisconnect");        
    session.clear();

    response.removeCookie("rememberme");

    for(String key : response.cookies.keySet()){
        response.removeCookie(key);
    }
    response.reset();

    Security.invoke("onDisconnected");
    Secure.login();
}

I am using the last code, I was including the removing cookies, for a while it worked, but now no longer work.

Somebody have a solution for that. I appreciate so much your help.

Answer 1

I would say that this is because when you hit "back" you are accessing the cache of your navigator. Try to hit "refresh" on this unauthorised page and you will that Play is not actually serving the page.

This article contains interesting information on the subject: http://www.codeproject.com/Tips/549347/Browser-Back-Button-Issue-After-Logout