put session condition on a previous page.if session is
invalidate redirect it to login  page.

there is not much that you can do in this secanario. The page  is cached by
your browser
so when you hit the back  button will cause the page to show up. You will
also notice
that no request will be send to your server so it does not help  if you check
for an empty
session or whatever was suggested before.
You can define in the meta tags of your html that the page should not be
cached by the browser.
However this works not always since certain browser does not care about
this. Another problem
is when you have a proxy in between.

you can solve your problem adding a javascript in your logout button  or
link.

make a redirect to your login.jsp page  then add a script
location.replace("login.jsp").

ex.
function doLogout()
{
window.location = "login.jsp";
window.replace("login.jps");
}

but you still have a problem, user could call a page throught the url, so don´t
forget to destroy your session and configure your login
page in yout web.xml when session is destroyed.