JavaWeb避免表单的重复提交

最新推荐文章于 2024-01-18 21:03:10 发布

A天道酬勤

最新推荐文章于 2024-01-18 21:03:10 发布

阅读量4.4k

点赞数

分类专栏： JavaEE篇

本文链接：https://blog.csdn.net/yuchao2015/article/details/57492248

版权

JavaEE篇专栏收录该内容

8 篇文章 0 订阅

订阅专栏

表单的重复提交

index.jsp

<form action="<%=request.getContextPath()%>/tokenServlet" method="post">
	name: <input type="text" name="name" /> 
	<input type="submit" value="Submit" />
</form>

TokenServlet.java

package com.xyc;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class TokenServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException,
            IOException {
        try {
            Thread.sleep(2000);//模拟网络延迟
        } catch (InterruptedException e) {
            e.printStackTrace();
        }
        
        request.setCharacterEncoding("UTF-8");
        
        String name = request.getParameter("name");

        System.out.println("name: " + name);

        request.getRequestDispatcher(request.getContextPath() + "/token/success.jsp").forward(request,
                response);
        // response.sendRedirect(request.getContextPath() + "/token/success.jsp");
    }

}

success.jsp

<h4>Success Page</h4>

表单的重复提交：

一、重复提交的情况：

①.在表单提交到一个Servlet中，而Servlet又通过请求转发的方式响应一个JSP页面,此时地址栏还保留着Servlet的那个路径，在相应页面点击"刷新"

②.由于网络原因在相应页面没有到达是重复点击提交表单

③.点击"返回"，然后再次点击"提交"

④.重定向还会重现上面②③点描述的情况，但是重定向后地址栏路径会发生改变，故不会出现①的情况

二、不是重复提交的情况

点击"返回","刷新"原表单页面，再"提交",不属于重复提交情况

如何避免表单的重复提交

解决方案：

①.仅提供一个隐藏域：<input type="hidden" name="token" value="tokenValue"/> 行不通：因为没有方法清除固定的请求参数

②.把标记放在request中，行不通，因为request作用域的原因，表单刷新后，request已经被销毁，在提交表单是一个新的request.

③.把标记放在session中，可以

> 在表单页面，生成一个随机值token

> 在原表单页面，把token值放入session中

> 在原表单中，把token值放入到隐藏域中

> 在目标的Servlet中：获取session 和隐藏域中的token值

> 比较两个值是否一致：若一致，受理请求，且把session域中的token清除 . 若不一致，则直接响应提示页面“表单重复提交”

实现一：

index.jsp

<%
	String tokenValue = new Date().getTime() + "";
	session.setAttribute("token", tokenValue);
%>

<form action="<%=request.getContextPath()%>/tokenServlet" method="post">

<input type="hidden" name="token"  value="<%=tokenValue %>"/>
	name: <input type="text" name="name" /> 
	<input type="submit" value="Submit" />
</form>

TokenServlet.java

package com.xyc;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class TokenServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException,
            IOException {
        try {
            Thread.sleep(2000);
        } catch (InterruptedException e) {
            e.printStackTrace();
        }

        request.setCharacterEncoding("UTF-8");

        String name = request.getParameter("name");

        HttpSession session = request.getSession();
        Object token = session.getAttribute("token");
        String tokenValue = request.getParameter("token");
        
        System.out.println(token);
        System.out.println(tokenValue);
        System.out.println("name: " + name);

        if (token != null && token.equals(tokenValue)) {
            session.removeAttribute("token");
        } else {
            response.sendRedirect(request.getContextPath() + "/token/token.jsp");
            return;
        }

        //request.getRequestDispatcher(request.getContextPath() + "/token/success.jsp").forward(request,response);
        response.sendRedirect(request.getContextPath() + "/token/success.jsp");
    }

}

success.jsp

<h4>对不起, 已经提交过了!</h4>

实现二(模仿Struts的实现)：

TokenProcessor.java

用于管理表单标识号的工具类，它主要用于产生、比较和清除存储在当前用户Session中的表单标识号。为了保证表单标识号的唯一性，每次将当前SessionID和系统时间的组合值按MD5算法计算的结果作为表单标识号，并且将TokenProcessor类设计为单例类

package com.xyc;


import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class TokenProcessor {

	private static final String TOKEN_KEY = "TOKEN_KEY";

	private static final String TRANSACTION_TOKEN_KEY = "TRANSACTION_TOKEN_KEY";

	private static TokenProcessor instance = new TokenProcessor();

	private long previous;

	protected TokenProcessor() {
		super();
	}

	public static TokenProcessor getInstance() {
		return instance;
	}

	public synchronized boolean isTokenValid(HttpServletRequest request) {
		return this.isTokenValid(request, false);
	}

	public synchronized boolean isTokenValid(HttpServletRequest request,
			boolean reset) {
		HttpSession session = request.getSession(false);

		if (session == null) {
			return false;
		}

		String saved = (String) session.getAttribute(TRANSACTION_TOKEN_KEY);

		if (saved == null) {
			return false;
		}

		if (reset) {
			this.resetToken(request);
		}

		String token = request.getParameter(TOKEN_KEY);

		if (token == null) {
			return false;
		}

		return saved.equals(token);
	}

	public synchronized void resetToken(HttpServletRequest request) {
		HttpSession session = request.getSession(false);

		if (session == null) {
			return;
		}

		session.removeAttribute(TRANSACTION_TOKEN_KEY);
	}

	public synchronized String saveToken(HttpServletRequest request) {
		HttpSession session = request.getSession();
		String token = generateToken(request);

		if (token != null) {
			session.setAttribute(TRANSACTION_TOKEN_KEY, token);
		}
		
		return token;
	}

	public synchronized String generateToken(HttpServletRequest request) {
		HttpSession session = request.getSession();

		return generateToken(session.getId());
	}

	public synchronized String generateToken(String id) {
		try {
			long current = System.currentTimeMillis();

			if (current == previous) {
				current++;
			}

			previous = current;

			byte[] now = new Long(current).toString().getBytes();
			MessageDigest md = MessageDigest.getInstance("MD5");

			md.update(id.getBytes());
			md.update(now);

			return toHex(md.digest());
		} catch (NoSuchAlgorithmException e) {
			return null;
		}
	}

	private String toHex(byte[] buffer) {
		StringBuffer sb = new StringBuffer(buffer.length * 2);

		for (int i = 0; i < buffer.length; i++) {
			sb.append(Character.forDigit((buffer[i] & 0xf0) >> 4, 16));
			sb.append(Character.forDigit(buffer[i] & 0x0f, 16));
		}

		return sb.toString();
	}
}

index.jsp

<%-- <%
	String tokenValue = new Date().getTime() + "";
	session.setAttribute("token", tokenValue);
%> --%>

<form action="<%=request.getContextPath()%>/tokenServlet" method="post">

<input type="hidden" name="TOKEN_KEY" 
		value="<%= TokenProcessor.getInstance().saveToken(request) %>"/>
<%-- <input type="hidden" name="token"  value="<%=tokenValue %>"/> --%>
	name: <input type="text" name="name" /> 
	<input type="submit" value="Submit" />
</form>

TokenServlet.java

package com.xyc;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class TokenServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException,
            IOException {
        try {
            Thread.sleep(2000);
        } catch (InterruptedException e) {
            e.printStackTrace();
        }

        request.setCharacterEncoding("UTF-8");

        /*String name = request.getParameter("name");

        HttpSession session = request.getSession();
        Object token = session.getAttribute("token");
        String tokenValue = request.getParameter("token");
        
        System.out.println(token);
        System.out.println(tokenValue);
        System.out.println("name: " + name);

        if (token != null && token.equals(tokenValue)) {
            session.removeAttribute("token");
        } else {
            response.sendRedirect(request.getContextPath() + "/token/token.jsp");
            return;
        }*/
        
        boolean valid = TokenProcessor.getInstance().isTokenValid(request);
        if(valid){
                TokenProcessor.getInstance().resetToken(request);
        }else{
                response.sendRedirect(request.getContextPath() + "/token/token.jsp");
                return;
        }

        //request.getRequestDispatcher(request.getContextPath() + "/token/success.jsp").forward(request,response);
        response.sendRedirect(request.getContextPath() + "/token/success.jsp");
    }

}

JS 客户端避免表单重复提交

利用Session实现一次性验证码

基本原理：和表单重复提交一致

> 在原表单页面，生成一个验证码的图片，生成图片的同时，需要把该图片中的字符串放入到session中

> 在原表单页面，定义一个文本域,用于输入验证码

> 在目标Servlet中：获取session和表单域中的验证码的值

> 标胶两个值是否一致，若一致，受理请求，且把sessin域中的验证码属性清除. 若不一致，直接通过重定向方式返回原表单页面，提示用户“验证码错误”

ValidateColorServlet.java

package com.xyc;


import java.awt.Color;
import java.awt.Font;
import java.awt.Graphics2D;
import java.awt.image.BufferedImage;
import java.io.IOException;
import java.util.Random;

import javax.imageio.ImageIO;
import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class ValidateColorServlet extends HttpServlet {

	public static final String CHECK_CODE_KEY = "CHECK_CODE_KEY";
	
	private static final long serialVersionUID = 1L;
	
	//设置验证图片的宽度, 高度, 验证码的个数
	private int width = 152;
	private int height = 40;
	private int codeCount = 4;
	
	//验证码字体的高度
	private int fontHeight = 4;
	
	//验证码中的单个字符基线. 即：验证码中的单个字符位于验证码图形左上角的 (codeX, codeY) 位置处
	private int codeX = 0;
	private int codeY = 0;
	
	//验证码由哪些字符组成
	char [] codeSequence = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz23456789".toCharArray();
	
	//初始化验证码图形属性
	public void init(){
		fontHeight = height - 2;
		codeX = width / (codeCount + 2);
		codeY = height - 4;
	}

	public void service(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
		//定义一个类型为 BufferedImage.TYPE_INT_BGR 类型的图像缓存
		BufferedImage buffImg = null;
		buffImg = new BufferedImage(width, height, BufferedImage.TYPE_3BYTE_BGR);
	
		//在 buffImg 中创建一个 Graphics2D 图像
		Graphics2D graphics = null;
		graphics = buffImg.createGraphics();
		
		//设置一个颜色, 使 Graphics2D 对象的后续图形使用这个颜色
		graphics.setColor(Color.WHITE);
		
		//填充一个指定的矩形: x - 要填充矩形的 x 坐标; y - 要填充矩形的 y 坐标; width - 要填充矩形的宽度; height - 要填充矩形的高度
		graphics.fillRect(0, 0, width, height);
		
		//创建一个 Font 对象: name - 字体名称; style - Font 的样式常量; size - Font 的点大小
		Font font = null;
		font = new Font("", Font.BOLD, fontHeight);
		//使 Graphics2D 对象的后续图形使用此字体
		graphics.setFont(font);
		
		graphics.setColor(Color.BLACK);
		
		//绘制指定矩形的边框, 绘制出的矩形将比构件宽一个也高一个像素
		graphics.drawRect(0, 0, width - 1, height - 1);
		
		//随机产生 15 条干扰线, 使图像中的认证码不易被其它程序探测到
		Random random = null;
		random = new Random();
		graphics.setColor(Color.GREEN);
		for(int i = 0; i < 55; i++){
			int x = random.nextInt(width);
			int y = random.nextInt(height);
			int x1 = random.nextInt(20);
			int y1 = random.nextInt(20);
			graphics.drawLine(x, y, x + x1, y + y1);
		}
		
		//创建 randomCode 对象, 用于保存随机产生的验证码, 以便用户登录后进行验证
		StringBuffer randomCode;
		randomCode = new StringBuffer();
		
		for(int i = 0; i < codeCount; i++){
			//得到随机产生的验证码数字
			String strRand = null;
			strRand = String.valueOf(codeSequence[random.nextInt(36)]);
			
			//把正在产生的随机字符放入到 StringBuffer 中
			randomCode.append(strRand);
			
			//用随机产生的颜色将验证码绘制到图像中
			graphics.setColor(Color.BLUE);
			graphics.drawString(strRand, (i + 1)* codeX, codeY);
		}
		
		//再把存放有所有随机字符的 StringBuffer 对应的字符串放入到 HttpSession 中
		request.getSession().setAttribute(CHECK_CODE_KEY, randomCode.toString());
		
		//禁止图像缓存
		response.setHeader("Pragma", "no-cache");
		response.setHeader("Cache-Control", "no-cache");
		response.setDateHeader("Expires", 0);
		
		//将图像输出到输出流中
		ServletOutputStream sos = null;
		sos = response.getOutputStream();
		ImageIO.write(buffImg, "jpeg", sos); 
		sos.close();
	}
}

CheckCodeServlet.java

package com.xyc;


import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class CheckCodeServlet extends HttpServlet {
	
	private static final long serialVersionUID = 1L;

	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		
	  //1. 获取请求参数: CHECK_CODE_PARAM_NAME
            String paramCode = request.getParameter("CHECK_CODE_PARAM_NAME");
            
            //2. 获取 session 中的 CHECK_CODE_KEY 属性值
            String sessionCode = (String)request.getSession().getAttribute("CHECK_CODE_KEY");
            
            System.out.println(paramCode);
            System.out.println(sessionCode); 
            
            //3. 比对. 看是否一致, 若一致说明验证码正确, 若不一致, 说明验证码错误
            if(!(paramCode != null && paramCode.equals(sessionCode))){
                    request.getSession().setAttribute("message", "验证码不一致!");
                    response.sendRedirect(request.getContextPath() + "/check/index.jsp");
                    return;
            }
            
            System.out.println("受理请求!");
		
	}

}

index.jsp

<font color="red">
	<%= session.getAttribute("message") == null ? "" : session.getAttribute("message")%>
</font>
<form action="<%= request.getContextPath() %>/checkCodeServlet" method="post">
	name: <input type="text" name="name"/>
	checkCode: <input type="text" name="CHECK_CODE_PARAM_NAME"/> 
	<img alt="" src="<%= request.getContextPath() %>/validateColorServlet"> 
	<input type="submit" value="Submit"/>
</form>

A天道酬勤

关注

0
点赞
踩
6

收藏

觉得还不错? 一键收藏
0
评论
JavaWeb避免表单的重复提交

表单的重复提交index.jsp/tokenServlet" method="post"> name: TokenServlet.javapackage com.xyc;import java.io.IOException;import javax.servlet.ServletException;import javax.ser
复制链接

扫一扫