java token 重复提交解决

package com.company.util;

import java.util.ArrayList;

import javax.servlet.http.HttpSession;

public class Token {

private static final String TOKEN_LIST_NAME = "tokenList";

public static final String TOKEN_STRING_NAME = "token";

private static ArrayList getTokenList(HttpSession session) {

       Object obj = session.getAttribute(TOKEN_LIST_NAME);

       if (obj != null) {

          return (ArrayList) obj;

       } else {

          ArrayList tokenList = new ArrayList();

          session.setAttribute(TOKEN_LIST_NAME, tokenList);

          return tokenList;

       }

    }

private static void saveTokenString(String tokenStr, HttpSession session) {

       ArrayList tokenList = getTokenList(session);

       tokenList.add(tokenStr);

       session.setAttribute(TOKEN_LIST_NAME, tokenList);

    }

private static String generateTokenString(){

       return new Long(System.currentTimeMillis()).toString();

    }

/** *//**

     * Generate a token string, and save the string in session, then return the token string.

     * 

     * @param HttpSession

     *            session

     * @return a token string used for enforcing a single request for a particular transaction.

     */

    public static String getTokenString(HttpSession session) {

       String tokenStr = generateTokenString();

       saveTokenString(tokenStr, session);

       return tokenStr;

    }
    public static boolean isTokenStringValid(String tokenStr, HttpSession session) {

       boolean valid = false;

       if(session != null){

          ArrayList tokenList = getTokenList(session);

          if (tokenList.contains(tokenStr)) {

             valid = true;

             tokenList.remove(tokenStr);

          }

       }

       return valid;

    }

}
在jsp页面端。首先import该类：<%@ page import="com.company.util.Token" %>表单包含隐藏的token字符串:<form><input type="hidden" name="<%=Token.TOKEN_STRING_NAME %>" value="<%=Token.getTokenString(session) %>"></form>

在Servlet中添加如下代码。if(Token.isTokenStringValid(request.getParameter(Token.TOKEN_STRING_NAME), request.getSession())){//进行正常业务流程

}else{

    告诉访问人不能重复提交。。。

}