session应用

• 用于保存用户登录信息
• 用于防止表单重复提交（也可以通过客户端判断表单是否已经提交过来防止表单重复提交，但是不能防止刷新造成的重复提交），而在服务器端防止表单重复提交的原理：表单由服务器动态生成，与此同时生成一个与之对应的随机数，并将随机数连同表单一起发送至客户端，客户端提交表单时携带随机数，服务器比对随机数，若相同则提交成功否则不接受提交信息。

FormServlet:

package cn.itcast.form;

import java.io.IOException;
import java.io.PrintWriter;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Random;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import sun.misc.BASE64Encoder;
//产生表单
public class FormServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        response.setContentType("text/html;charset=UTF-8");
        response.setCharacterEncoding("UTF-8");
        PrintWriter  out = response.getWriter();


        String token = TokenProcessor.getInstance().generateToken();
        request.getSession().setAttribute("token", token);

        out.print("<form action='/day07/servlet/FormSubmitServlet' method='post'>");
            out.print("<input type='hidden' name='token' value='"+token+"'>");
            out.print("<input type='text' name='username'>");
            out.print("<input type='submit' value='提交'>");
        out.print("</form>");


    }

    public void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        doGet(request, response);
    }
}

class TokenProcessor{
    //1.  把构造方法私有
    //2.  自己产生一个类的对象
    //3.  定义一个方法返回上面产生的对象

    private TokenProcessor(){};
    public static final TokenProcessor instance = new TokenProcessor();
    public static TokenProcessor getInstance(){
        return instance;
    }

    public String generateToken(){

        //3843849384   9849238402840243802  983434
        String token = System.currentTimeMillis() + "" + new Random().nextInt(99999999);

        //数据指纹 数据摘要  md5
        try {
            MessageDigest md = MessageDigest.getInstance("md5"); 
            byte md5[] = md.digest(token.getBytes());   //128位  16【12，23，34，544543543543，】

            //base64编码    SABDSSDSD
            BASE64Encoder encoder = new BASE64Encoder();
            return encoder.encode(md5);
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException(e);
        }
    }
}

FormSubmitServlet:

package cn.itcast.form;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class FormSubmitServlet extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        boolean b = isToken(request);
        if(!b){
            //用户带过来的令牌无效，阻止提交
            System.out.println("你是重复提交！！");
            return;
        }

        //用户带过来的令牌有效，处理提交
        request.getSession().removeAttribute("token");

        String username = request.getParameter("username");
        //把用户提交的数据保存到数据库中
        System.out.println("处理提交请求，把" + username + "保存到数库中！！");

    }

    //判断用户带过来的令牌是否有效
    private synchronized boolean isToken(HttpServletRequest request) {
        String client_token = request.getParameter("token");
        if(client_token==null){
            return false;
        }

        String server_token = (String) request.getSession().getAttribute("token");
        if(server_token==null){
            return false;
        }

        if(!client_token.equals(server_token)){
            return false;
        }

        return true;
    }

    public void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        doGet(request, response);
    }

}