JavaServer Pages, 3rd Edition

Logging Out

Because the proof of authentication is kept in the session scope, the user is automatically logged out when the session times out. Even so, an application that requires authentication should always provide a way for the user to explicitly log out. This way a user can be sure that if he leaves the desk, no one else can come by and use the application.

The main page in the example application contains a link to the logout page, shown in Example 13-7.

Example 13-7. Logout page (logout.jsp)

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="ora" uri="orataglib" %>
  
<%-- 
  Terminate the session and redirect to the login page.
--%>
<ora:invalidateSession/>
  
<c:redirect url="login.jsp" />

This page explicitly terminates the session using the <ora:invalidateSession> custom action (no attributes supported) and then redirects back to the login page. Invalidating the session means that all session scope variables are removed, and the session is marked as invalid. The next time someone logs in, a new session is created.

The <ora:invalidateSession> custom action implementation is very simple and arguable overkill. If you don’t mind using JSP scripting elements (described in Chapter 16) in your pages, this scriptlet is an alternative to using the custom action:

<% session.invalidate(  ); %>

If you want to test the sample application described in this chapter, you must first create at least one user with the example application developed in Chapter 12. To see ...