如果用户回退到刚才的提交页面并再次提交的话，客户端传过来的令牌就和服务器端的令牌不一致，从而有效地防止了重复提交的发生。//验证事务控制令牌,会自动根据session中标识生成一个隐含input代表令牌，防止两次提交。
在JSP/Servlet中可以
JSP页面
SynchroToken.java
package com.lims.util;
import org.apache.struts.util.*;
import javax.servlet.http.*;
import javax.servlet.jsp.*;
import org.apache.struts.action.*;
/**
*
Title: SynchroToken
*
Description:
*
Copyright: Copyright (c) 2004
*
Company: NetStar
* @author Jstar
* @version 1.0
* Created in 2004/04/21
*/
public class SynchroToken{
public final static java.lang.String TOKEN_NAME = "_token";
public static boolean checkToken (HttpServletRequest request){
boolean isEqual = false;
HttpSession session = request.getSession ();
String formToken = request.getParameter (TOKEN_NAME);
String sessionToken = (String)session.getAttribute (TOKEN_NAME);
System.out.println ("formToken: " + formToken + " sessionToken: " +
sessionToken);
if (formToken != null && sessionToken == null){
session.setAttribute (TOKEN_NAME, formToken);
isEqual = true;
}
return isEqual;
}
/**
* Insert the method's description here.
* Creation date: (4/19/2004 3:23:25 PM)
* @return java.lang.String
* @param request javax.servlet.http.HttpServletRequest
*/
public static String getToken (HttpServletRequest request){
String token = "" + System.currentTimeMillis ();
HttpSession session = request.getSession ();
if (session != null){
session.removeAttribute (TOKEN_NAME);
}
return token;z
}
/**
* Insert the method's description here.
* Creation date: (4/19/2004 3:24:10 PM)
* @return java.lang.String
*/
final static java.lang.String getTOKEN_NAME (){
return TOKEN_NAME;
}
public static String message (PageContext pageContext, String key) throws
JspException{
return RequestUtils.message (pageContext, null, null, key);
}
} |