i stuck by a line with "session.invalidate()", after user logout also by pressing the back button of the browser user is still able to navigate to his home page and able to view the session variable....i tried even with setheaders also but no luck..... please suggest me the solution to fix this ....thank u