i guess the user can directly access the loginsuccess.jsp page by giving the url. I have been doing this, but I really don't know how to prevent this from happening..
it were just a servlet app, i would use request dispatcher to /WEB-INF/*.jsp page, and those pages can be accessed directly...
View All Comments
| View Tutorial