表单的重复提交
index.jsp
<form action="<%=request.getContextPath()%>/tokenServlet" method="post">
name: <input type="text" name="name" />
<input type="submit" value="Submit" />
</form>
package com.xyc;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
public class TokenServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException,
IOException {
try {
Thread.sleep(2000);//模拟网络延迟
} catch (InterruptedException e) {
e.printStackTrace();
}
request.setCharacterEncoding("UTF-8");
String name = request.getParameter("name");
System.out.println("name: " + name);
request.getRequestDispatcher(request.getContextPath() + "/token/success.jsp").forward(request,
response);
// response.sendRedirect(request.getContextPath() + "/token/success.jsp");
}
}
success.jsp
<h4>Success Page</h4>
表单的重复提交:
一、重复提交的情况:
①.在表单提交到一个Servlet中,而Servlet又通过请求转发的方式响应一个JSP页面,此时地址栏还保留着Servlet的那个路径,在相应页面点击"刷新"
②.由于网络原因在相应页面没有到达是重复点击提交表单
③.点击"返回",然后再次点击"提交"
④.重定向还会重现上面②③点描述的情况,但是重定向后地址栏路径会发生改变,故不会出现①的情况
二、不是重复提交的情况
点击"返回","刷新"原表单页面,再"提交",不属于重复提交情况
如何避免表单的重复提交
解决方案:
①.仅提供一个隐藏域:<input type="hidden" name="token" value="tokenValue"/> 行不通:因为没有方法清除固定的请求参数
②.把标记放在request中,行不通,因为request作用域的原因,表单刷新后,request已经被销毁,在提交表单是一个新的request.
③.把标记放在session中,可以
> 在表单页面,生成一个随机值token
> 在原表单页面,把token值放入session中
> 在原表单中,把token值放入到隐藏域中
> 在目标的Servlet中:获取session 和隐藏域中的token值
> 比较两个值是否一致:若一致,受理请求,且把session域中的token清除 . 若不一致,则直接响应提示页面“表单重复提交”
实现一:
index.jsp
<%
String tokenValue = new Date().getTime() + "";
session.setAttribute("token", tokenValue);
%>
<form action="<%=request.getContextPath()%>/tokenServlet" method="post">
<input type="hidden" name="token" value="<%=tokenValue %>"/>
name: <input type="text" name="name" />
<input type="submit" value="Submit" />
</form>
TokenServlet.java
package com.xyc;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
public class TokenServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException,
IOException {
try {
Thread.sleep(2000);
} catch (InterruptedException e) {
e.printStackTrace();
}
request.setCharacterEncoding("UTF-8");
String name = request.getParameter("name");
HttpSession session = request.getSession();
Object token = session.getAttribute("token");
String tokenValue = request.getParameter("token");
System.out.println(token);
System.out.println(tokenValue);
System.out.println("name: " + name);
if (token != null && token.equals(tokenValue)) {
session.removeAttribute("token");
} else {
response.sendRedirect(request.getContextPath() + "/token/token.jsp");
return;
}
//request.getRequestDispatcher(request.getContextPath() + "/token/success.jsp").forward(request,response);
response.sendRedirect(request.getContextPath() + "/token/success.jsp");
}
}
success.jsp
<h4>对不起, 已经提交过了!</h4>
实现二(模仿Struts的实现):
TokenProcessor.java
用于管理表单标识号的工具类,它主要用于产生、比较和清除存储在当前用户Session中的表单标识号。为了保证表单标识号的唯一性,每次将当前SessionID和系统时间的组合值按MD5算法计算的结果作为表单标识号,并且将TokenProcessor类设计为单例类
package com.xyc;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
public class TokenProcessor {
private static final String TOKEN_KEY = "TOKEN_KEY";
private static final String TRANSACTION_TOKEN_KEY = "TRANSACTION_TOKEN_KEY";
private static TokenProcessor instance = new TokenProcessor();
private long previous;
protected TokenProcessor() {
super();
}
public static TokenProcessor getInstance() {
return instance;
}
public synchronized boolean isTokenValid(HttpServletRequest request) {
return this.isTokenValid(request, false);
}
public synchronized boolean isTokenValid(HttpServletRequest request,
boolean reset) {
HttpSession session = request.getSession(false);
if (session == null) {
return false;
}
String saved = (String) session.getAttribute(TRANSACTION_TOKEN_KEY);
if (saved == null) {
return false;
}
if (reset) {
this.resetToken(request);
}
String token = request.getParameter(TOKEN_KEY);
if (token == null) {
return false;
}
return saved.equals(token);
}
public synchronized void resetToken(HttpServletRequest request) {
HttpSession session = request.getSession(false);
if (session == null) {
return;
}
session.removeAttribute(TRANSACTION_TOKEN_KEY);
}
public synchronized String saveToken(HttpServletRequest request) {
HttpSession session = request.getSession();
String token = generateToken(request);
if (token != null) {
session.setAttribute(TRANSACTION_TOKEN_KEY, token);
}
return token;
}
public synchronized String generateToken(HttpServletRequest request) {
HttpSession session = request.getSession();
return generateToken(session.getId());
}
public synchronized String generateToken(String id) {
try {
long current = System.currentTimeMillis();
if (current == previous) {
current++;
}
previous = current;
byte[] now = new Long(current).toString().getBytes();
MessageDigest md = MessageDigest.getInstance("MD5");
md.update(id.getBytes());
md.update(now);
return toHex(md.digest());
} catch (NoSuchAlgorithmException e) {
return null;
}
}
private String toHex(byte[] buffer) {
StringBuffer sb = new StringBuffer(buffer.length * 2);
for (int i = 0; i < buffer.length; i++) {
sb.append(Character.forDigit((buffer[i] & 0xf0) >> 4, 16));
sb.append(Character.forDigit(buffer[i] & 0x0f, 16));
}
return sb.toString();
}
}
index.jsp
<%-- <%
String tokenValue = new Date().getTime() + "";
session.setAttribute("token", tokenValue);
%> --%>
<form action="<%=request.getContextPath()%>/tokenServlet" method="post">
<input type="hidden" name="TOKEN_KEY"
value="<%= TokenProcessor.getInstance().saveToken(request) %>"/>
<%-- <input type="hidden" name="token" value="<%=tokenValue %>"/> --%>
name: <input type="text" name="name" />
<input type="submit" value="Submit" />
</form>
TokenServlet.java
package com.xyc;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
public class TokenServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException,
IOException {
try {
Thread.sleep(2000);
} catch (InterruptedException e) {
e.printStackTrace();
}
request.setCharacterEncoding("UTF-8");
/*String name = request.getParameter("name");
HttpSession session = request.getSession();
Object token = session.getAttribute("token");
String tokenValue = request.getParameter("token");
System.out.println(token);
System.out.println(tokenValue);
System.out.println("name: " + name);
if (token != null && token.equals(tokenValue)) {
session.removeAttribute("token");
} else {
response.sendRedirect(request.getContextPath() + "/token/token.jsp");
return;
}*/
boolean valid = TokenProcessor.getInstance().isTokenValid(request);
if(valid){
TokenProcessor.getInstance().resetToken(request);
}else{
response.sendRedirect(request.getContextPath() + "/token/token.jsp");
return;
}
//request.getRequestDispatcher(request.getContextPath() + "/token/success.jsp").forward(request,response);
response.sendRedirect(request.getContextPath() + "/token/success.jsp");
}
}
JS 客户端避免表单重复提交
利用Session实现一次性验证码
package com.xyc;
import java.awt.Color;
import java.awt.Font;
import java.awt.Graphics2D;
import java.awt.image.BufferedImage;
import java.io.IOException;
import java.util.Random;
import javax.imageio.ImageIO;
import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
public class ValidateColorServlet extends HttpServlet {
public static final String CHECK_CODE_KEY = "CHECK_CODE_KEY";
private static final long serialVersionUID = 1L;
//设置验证图片的宽度, 高度, 验证码的个数
private int width = 152;
private int height = 40;
private int codeCount = 4;
//验证码字体的高度
private int fontHeight = 4;
//验证码中的单个字符基线. 即:验证码中的单个字符位于验证码图形左上角的 (codeX, codeY) 位置处
private int codeX = 0;
private int codeY = 0;
//验证码由哪些字符组成
char [] codeSequence = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz23456789".toCharArray();
//初始化验证码图形属性
public void init(){
fontHeight = height - 2;
codeX = width / (codeCount + 2);
codeY = height - 4;
}
public void service(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
//定义一个类型为 BufferedImage.TYPE_INT_BGR 类型的图像缓存
BufferedImage buffImg = null;
buffImg = new BufferedImage(width, height, BufferedImage.TYPE_3BYTE_BGR);
//在 buffImg 中创建一个 Graphics2D 图像
Graphics2D graphics = null;
graphics = buffImg.createGraphics();
//设置一个颜色, 使 Graphics2D 对象的后续图形使用这个颜色
graphics.setColor(Color.WHITE);
//填充一个指定的矩形: x - 要填充矩形的 x 坐标; y - 要填充矩形的 y 坐标; width - 要填充矩形的宽度; height - 要填充矩形的高度
graphics.fillRect(0, 0, width, height);
//创建一个 Font 对象: name - 字体名称; style - Font 的样式常量; size - Font 的点大小
Font font = null;
font = new Font("", Font.BOLD, fontHeight);
//使 Graphics2D 对象的后续图形使用此字体
graphics.setFont(font);
graphics.setColor(Color.BLACK);
//绘制指定矩形的边框, 绘制出的矩形将比构件宽一个也高一个像素
graphics.drawRect(0, 0, width - 1, height - 1);
//随机产生 15 条干扰线, 使图像中的认证码不易被其它程序探测到
Random random = null;
random = new Random();
graphics.setColor(Color.GREEN);
for(int i = 0; i < 55; i++){
int x = random.nextInt(width);
int y = random.nextInt(height);
int x1 = random.nextInt(20);
int y1 = random.nextInt(20);
graphics.drawLine(x, y, x + x1, y + y1);
}
//创建 randomCode 对象, 用于保存随机产生的验证码, 以便用户登录后进行验证
StringBuffer randomCode;
randomCode = new StringBuffer();
for(int i = 0; i < codeCount; i++){
//得到随机产生的验证码数字
String strRand = null;
strRand = String.valueOf(codeSequence[random.nextInt(36)]);
//把正在产生的随机字符放入到 StringBuffer 中
randomCode.append(strRand);
//用随机产生的颜色将验证码绘制到图像中
graphics.setColor(Color.BLUE);
graphics.drawString(strRand, (i + 1)* codeX, codeY);
}
//再把存放有所有随机字符的 StringBuffer 对应的字符串放入到 HttpSession 中
request.getSession().setAttribute(CHECK_CODE_KEY, randomCode.toString());
//禁止图像缓存
response.setHeader("Pragma", "no-cache");
response.setHeader("Cache-Control", "no-cache");
response.setDateHeader("Expires", 0);
//将图像输出到输出流中
ServletOutputStream sos = null;
sos = response.getOutputStream();
ImageIO.write(buffImg, "jpeg", sos);
sos.close();
}
}
CheckCodeServlet.java
package com.xyc;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
public class CheckCodeServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
//1. 获取请求参数: CHECK_CODE_PARAM_NAME
String paramCode = request.getParameter("CHECK_CODE_PARAM_NAME");
//2. 获取 session 中的 CHECK_CODE_KEY 属性值
String sessionCode = (String)request.getSession().getAttribute("CHECK_CODE_KEY");
System.out.println(paramCode);
System.out.println(sessionCode);
//3. 比对. 看是否一致, 若一致说明验证码正确, 若不一致, 说明验证码错误
if(!(paramCode != null && paramCode.equals(sessionCode))){
request.getSession().setAttribute("message", "验证码不一致!");
response.sendRedirect(request.getContextPath() + "/check/index.jsp");
return;
}
System.out.println("受理请求!");
}
}
index.jsp
<font color="red">
<%= session.getAttribute("message") == null ? "" : session.getAttribute("message")%>
</font>
<form action="<%= request.getContextPath() %>/checkCodeServlet" method="post">
name: <input type="text" name="name"/>
checkCode: <input type="text" name="CHECK_CODE_PARAM_NAME"/>
<img alt="" src="<%= request.getContextPath() %>/validateColorServlet">
<input type="submit" value="Submit"/>
</form>