Introduction

On Android, logging out is not just about clearing a token or user object. You also need to reset navigation so the Back button cannot reopen screens that should be available only to an authenticated user.

The standard fix is to launch the post-logout screen with task-clearing flags so the old activity stack is removed. If the user then presses Back, there is no protected activity left underneath.

Clear The Task When Navigating To Login

A common logout pattern looks like this:

1Intent intent = new Intent(this, LoginActivity.class);
2intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK);
3startActivity(intent);
4finish();

This does two important things:

• 'FLAG_ACTIVITY_NEW_TASK starts a new task'
• 'FLAG_ACTIVITY_CLEAR_TASK clears the existing task before the new activity starts'

The result is that LoginActivity becomes the only activity left in the task.

Why finish() Alone Is Not Enough

Calling finish() only closes the current activity. If several authenticated activities are underneath it in the back stack, the user may still navigate back into them.

That is why logout needs to think in terms of the whole task, not just the currently visible screen.

Recheck Authentication On Protected Screens

Clearing the task is the main navigation fix, but protected activities should still verify authentication in onStart or a similar lifecycle method. That way, even if a deep link, process restore, or unexpected navigation path reaches the screen, the activity can redirect safely.

1@Override
2protected void onStart() {
3    super.onStart();
4    if (!sessionManager.isLoggedIn()) {
5        Intent intent = new Intent(this, LoginActivity.class);
6        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK);
7        startActivity(intent);
8        finish();
9    }
10}

This is defense in depth: clear the back stack on logout, and also guard protected screens when they start.

Logout Should Also Clear Sensitive State

Navigation flags solve the back-stack problem, but logout usually also needs to clear tokens, cached user data, and in-memory session objects. If those values survive, the navigation fix may hide the symptom without fully ending the authenticated session.

Consider The Task Root Of The App

Apps that use notifications, deep links, or multiple tasks should test logout behavior across all of those entry points. Clearing one visible activity chain is necessary, but the real goal is stronger: no navigation path should restore a protected screen after the session is gone.

Server Checks Still Matter

Even after clearing the Android back stack, server-backed apps should still reject requests made with invalidated tokens or expired sessions. Client navigation cleanup improves UX and security posture, but it should complement server-side access control rather than replace it.

That keeps logout behavior aligned with the real security model.

It also keeps testing of logout flows grounded in real access control.

The safest logout flow is the one you can test repeatedly without surprises.

Common Pitfalls

• Calling finish() on the current activity and assuming the whole authenticated stack is gone.
• Clearing credentials but leaving the old task intact.
• Relying only on navigation flags without rechecking auth in protected activities.
• Forgetting process restore and deep-link entry points.
• Treating logout as a UI event instead of as a security boundary.

Summary

• On logout, clear the activity task so Back cannot reopen authenticated screens.
• Use FLAG_ACTIVITY_NEW_TASK | FLAG_ACTIVITY_CLEAR_TASK when launching the login screen.
• 'finish() alone is not enough if other protected activities remain on the stack.'
• Protected activities should still recheck authentication when they start.
• Good logout behavior is both a navigation fix and a security requirement.