// 注销
 private void logout(HttpServletRequest request, HttpServletResponse response)
   throws ServletException, IOException {
  HttpSession session = request.getSession();
  request.setAttribute("sessionId", session.getId());
  session.removeAttribute("user");
  session.invalidate();
  response.sendRedirect(request.getContextPath() + "/index.jsp");
 } 

<%
String token=new Random().nextLong()+"";
session.setAttribute("token", token);
%>
<form action="${pageContext.request.contextPath}/servlet/ClientServlet?operation=login" method="post">
<table style="width: 50%;">
<tr>
<td align="right">姓名：</td>
<td><input type="text" name="name"></td>
</tr>
<tr>
<td align="right">密码：</td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<tr>
<td></td>
<td><input type="submit" value="登录"></td>
</tr>
</table>
<input type="hidden" name="token" value="${sessionScope.token}">
</form> 

  HttpSession session = request.getSession();
  //解决注销后后退刷新浏览器重复登录的问题
  //给一个隐藏输入域，后台获取隐藏域的值
  //注销后后退刷新浏览器会生成新的session，这样sessionToken获取为null
  //这样hiddenToken.equals(sessionToken)就一定是false
  String sessionToken = (String) session.getAttribute("token");
  String hiddenToken = request.getParameter("token");
  if (!hiddenToken.equals(sessionToken)) {
   request.setAttribute("message", "您已注销，请重新登录,2秒后转向登录页面<meta http-equiv='Refresh' content=2;url="
       + request.getContextPath() + "/client/login.jsp>");
   request.getRequestDispatcher("/client/message.jsp").forward(
     request, response);
   return;
  }