pressing back to login again

[jflinchbaugh]

using jboss 2.4.4/tomcat 4.0.1 package, i have a problem with form-based authentication. it all works as expected, but users cause problems as usual.

if a user requests a protected resource, logs in, then hits back, and attempts to login again, i get:
The requested resource (/j_security_check) is not available

how can i avoid seeing this error and just have the container just invalidate their old session and start a new?

thanks.

[mkotsbak]

Try setting a session property on a page after user is logged in, and check that one in the login-form page. If it is set, redirect to the secured part of the site.

[jflinchbaugh]

yes, i would expect that to work for someone who hits the login page directly -- direct them somewhere else. but in the case of pressing the back button, they don't hit the server again, they just view it from their cache. j_security_check doesn't exist on this next invocation from the form action.

it almost feels like i need j_security_check to always exist and have that do the actual invalidation of the session and reinstatement.

[mkotsbak]

Maybe you could eliminate that problem by setting the expire time for the login-page in some http-header. I don't know if it will work in all browser though.

[jflinchbaugh]

did some playing around, and found that jetty will let me hit back and login again just fine without reporting j_security_check as unavailable.

now jetty seems to have some other sporadic form-based login issues, but i think i've narrowed it to a tomcat problem.

i'll have to try it on weblogic sometime.

[jflinchbaugh]

hmmm...indeed a tomcat bug:
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=6279

i'll have to see if tomcat 4.0.2 fixes it.