jsp/servlet防止刷新/后退引起的重复提交问题的Java Token代码

首先是Token主类。类很简单


package com.company.util;




import java.util.ArrayList;




import javax.servlet.http.HttpSession;






public class Token

{




private static final String TOKEN_LIST_NAME = "tokenList";




public static final String TOKEN_STRING_NAME = "token";






private static ArrayList getTokenList(HttpSession session)

{


Object obj = session.getAttribute(TOKEN_LIST_NAME);




if (obj != null)

{


return (ArrayList) obj;




} else

{


ArrayList tokenList = new ArrayList();


session.setAttribute(TOKEN_LIST_NAME, tokenList);


return tokenList;


}


}






private static void saveTokenString(String tokenStr, HttpSession session)

{


ArrayList tokenList = getTokenList(session);


tokenList.add(tokenStr);


session.setAttribute(TOKEN_LIST_NAME, tokenList);


}







private static String generateTokenString()

{


return new Long(System.currentTimeMillis()).toString();


}






/** *//**


* Generate a token string, and save the string in session, then return the token string.


*


* @param HttpSession


* session


* @return a token string used for enforcing a single request for a particular transaction.


*/




public static String getTokenString(HttpSession session)

{


String tokenStr = generateTokenString();


saveTokenString(tokenStr, session);


return tokenStr;


}






/** *//**


* check whether token string is valid. if session contains the token string, return true.


* otherwise, return false.


*


* @param String


* tokenStr


* @param HttpSession


* session


* @return true: session contains tokenStr; false: session is null or tokenStr is id not in session


*/




public static boolean isTokenStringValid(String tokenStr, HttpSession session)

{


boolean valid = false;




if(session != null)

{


ArrayList tokenList = getTokenList(session);




if (tokenList.contains(tokenStr))

{


valid = true;


tokenList.remove(tokenStr);


}


}


return valid;


}


}

在jsp页面端。
首先import该类：
<%@ page import="com.company.util.Token" %>
表单包含隐藏的token字符串:



<form>








<input type="hidden" name="<%=Token.TOKEN_STRING_NAME %>" value="<%=Token.getTokenString(session) %>">








</form>

在Servlet中添加如下代码。





if(Token.isTokenStringValid(request.getParameter(Token.TOKEN_STRING_NAME), request.getSession()))

{


//进行正常业务流程


}




else

{


//进行防重复提交处理流程，可以不做任何处理


}