java web笔记——服务器端防刷新页面重复提交表单

简易的防止恶意提交表单，刷新页面重复提交，在没有禁止Cookie的情况下防止重启浏览器重复提交。

用Session设置令牌属性，提交后删除Session中的令牌。

Session记录上次提交的时间，短时间内无法重复提交。

表单Servlet :

package CookieSession;

import java.io.IOException;
import java.io.PrintWriter;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Random;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import sun.misc.BASE64Encoder;

/**
* Servlet implementation class FormServlet
*/
public class FormServlet extends HttpServlet {
private static final long serialVersionUID = 1L;

/**
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
*/
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
// TODO Auto-generated method stub
response.setContentType("text/html;charset=UTF-8");
response.setCharacterEncoding("UTF-8");
PrintWriter out = response.getWriter();

String token = TokenProcessor.getInstance().generateToken();
request.getSession().setAttribute("token", token);

String URL = response.encodeURL("/practice/FormSubmitServlet");
out.print("<form action='"+URL+"' method='post'>");
out.print("<input type='hidden' name='token' value='"+token+"'>");
out.print("<input type='text' name='username'>");
out.print("<input type='submit' value='提交'>");
out.print("</form>");
}

/**
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
*/
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
// TODO Auto-generated method stub
doGet(request, response);
}

}

class TokenProcessor {
//构造方法私有，自己产生一个类的对象，定义一个方法返回产生的对象

private TokenProcessor() {};
public static final TokenProcessor instance = new TokenProcessor();
public static TokenProcessor getInstance() {
return instance;
}

public String generateToken() {
String token = System.currentTimeMillis() + "" + new Random().nextInt(99999999);//随机一个令牌

try {
MessageDigest md = MessageDigest.getInstance("md5");
byte[] md5 = md.digest(token.getBytes()); //转换成数据指纹

return new BASE64Encoder().encode(md5);//base64编码后输出
} catch (NoSuchAlgorithmException e) {
// TODO Auto-generated catch block
throw new RuntimeException(e);
}

}

数据处理Servlet :

package CookieSession;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

/**
* Servlet implementation class FormSubmitServlet
*/
public class FormSubmitServlet extends HttpServlet {
private static final long serialVersionUID = 1L;

/**
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
*/
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
// TODO Auto-generated method stub
boolean b = isToken(request);
if(!b) {
System.out.println("表单重复提交");
return;
}

HttpSession session = request.getSession();
Cookie cookie = new Cookie("JSESSIONID", session.getId());
cookie.setPath("/practice");
cookie.setMaxAge(10*60);
response.addCookie(cookie);

String time = Long.toString(System.currentTimeMillis());
if(session.getAttribute("lastSubmit") != null) {//防止刷新页面重复提交
String lastSubmit = (String)session.getAttribute("lastSubmit");
long cut = Long.parseLong(time) - Long.parseLong(lastSubmit);
if(cut < 10*60*1000) {//两次提交时间小于10分钟
//System.out.println(time+","+lastSubmit);
System.out.println("不得重复提交");
return;
}
}

String username = request.getParameter("username");
try {
Thread.sleep(2000);
} catch (InterruptedException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
System.out.println(username + "数据已保存");

session.removeAttribute("token");
session.setAttribute("lastSubmit", time);

}

/**
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
*/
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
// TODO Auto-generated method stub
doGet(request, response);
}

public static boolean isToken(HttpServletRequest request) {
String client_token = request.getParameter("token");
if(client_token == null) {
System.out.println("1");
return false;
}

String server_token = (String)request.getSession().getAttribute("token");
if(server_token == null) {
System.out.println("2");
return false;
}

if(!server_token.equals(client_token)) {
System.out.println("3");
return false;
}

return true;
}

}