How to invalidate Wicket session

Question

I have a Wicket (6.9.0) application that takes user input on a couple of pages, processes the data and finally shows a page that gives a summary of the input. The application stores some data in the session so I want to invalidate it in the end so that the user can't go back an continue with stale session data.

I tried to use session.invalidate() in my summary page, first in the constructor and then in onAfterRender() but both times I ended up seeing the "Page Expired" page and not the output of my summary page.

Is there a way to show my summary page and then invalidate my session? Or is this something that should not be done in Wicket?

Answer 1

The "Page expired" problem is caused by the render strategy of the framework. By default Wicket uses a redirect-after-post strategy for rendering a page. So if the session is invalidated somewhere in the Page, the following get-request will always show the "Page Expired" message because the session no longer exists.

The simple solution is to change the render strategy in the Application init method:

@Override
protected void init() {
   super.init();
   getRequestCycleSettings().setRenderStrategy(RenderStrategy.ONE_PASS_RENDER);
}

The downside of this solution is that it suffers from the 'double submit problem' when users press the refresh button on their browser.

Answer 2

If you invalidate your session in the constructor on onAfterRender then this is before the page gets displayed and that's why you see the Page Expired Page.

You could:

• place a button on your summary page and after clicking it invalidate the session
• in the constructor of the summary page null all session data
• you could invalidate your session in onRemove, but i dont know if you'll ever get there
• or you want to disable the back button then see something like this: http://blog.55minutes.com/2011/10/how-to-defeat-the-browser-back-button-cache/