title: Preventing ViewExpiredException when clicking broswer back button after session invalidation
body: <p>I am trying to figure out how to prevent <a href="https://www.owasp.org/index.php/Session_fixation" rel="nofollow noreferrer">Session Fixation</a> on an JSF login form in Glassfish 3.1.
  It was easy to do with <a href="https://stackoverflow.com/questions/1163319/java-secure-session">Servlets</a>, so I am trying to do the same with JSF (based on this question: <a href="https://stackoverflow.com/q/772541/587642">Retrieving session ID value from a JSF request</a>):</p>
  
  <pre><code>FacesContext fCtx = FacesContext.getCurrentInstance();
  HttpSession session = (HttpSession) fCtx.getExternalContext().getSession(false);
  session.invalidate();   
  fCtx.getExternalContext().getSession(true); 
  </code></pre>
  
  <p>It seems to work, but when I click the browser's back button and re-enter login details I get:</p>
  
  <blockquote>
    <p>javax.faces.application.ViewExpiredException:
    viewId:/index.xhtml - View
    /index.xhtml could not be restored.</p>
  </blockquote>
  
  <p>It works again only after "refresh" and resend.</p>
  
  <p>What could be the reason for that?</p>