Struts防止重复提交

首先我们先看看token源代码

package org.apache.struts.util;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

public class TokenProcessor
{
  private static TokenProcessor instance = new TokenProcessor();

  public static TokenProcessor getInstance()
  {
    return instance;
  }

  public synchronized boolean isTokenValid(HttpServletRequest request)
  {
    return isTokenValid(request, false);
  }

  public synchronized boolean isTokenValid(HttpServletRequest request, boolean reset)
  {
    HttpSession session = request.getSession(false);
    if (session == null) {
      return false;
    }

    String saved = (String)session.getAttribute("org.apache.struts.action.TOKEN");
    if (saved == null) {
      return false;
    }

    if (reset) {
      resetToken(request);
    }

    String token = request.getParameter("org.apache.struts.taglib.html.TOKEN");
    if (token == null) {
      return false;
    }

    return saved.equals(token);
  }

  public synchronized void resetToken(HttpServletRequest request)
  {
    HttpSession session = request.getSession(false);
    if (session == null) {
      return;
    }
    session.removeAttribute("org.apache.struts.action.TOKEN");
  }

  public synchronized void saveToken(HttpServletRequest request)
  {
    HttpSession session = request.getSession();
    String token = generateToken(request);
    if (token != null)
      session.setAttribute("org.apache.struts.action.TOKEN", token);
  }

  public String generateToken(HttpServletRequest request)
  {
    HttpSession session = request.getSession();
    try {
      byte[] id = session.getId().getBytes();
      byte[] now = new Long(System.currentTimeMillis()).toString().getBytes();
      MessageDigest md = MessageDigest.getInstance("MD5");
      md.update(id);
      md.update(now);
      return toHex(md.digest());
    }
    catch (IllegalStateException e) {
      return null; } catch (NoSuchAlgorithmException e) {
    }
    return null;
  }

  public String toHex(byte[] buffer)
  {
    StringBuffer sb = new StringBuffer();
    String s = null;
    for (int i = 0; i < buffer.length; ++i) {
      s = Integer.toHexString(buffer[i] & 0xFF);
      if (s.length() < 2) {
        sb.append('0');
      }
      sb.append(s);
    }
    return sb.toString();
  }
}

一般使用方法是
1、在进入页面之前先使用saveToekn()方法，该方法会在当前session和返回的页面各生成一个toekn值，生成的页面值如下形式<input type='hidden'name='org.apache.struts.taglib.html.TOKEN' value="XXXXXX">，
2、form submit，此时会把页面token当作一个参数传到后台
3、用isTokenValid(reqiest,true)方法比较session Token 和request 中的Token是否相等，如果是按照上面的流程来，那么肯定是相等的


下面我们分析重复提交的情景：
1、在insert后按F5，这个最好控制，因为F5每次请求的URL是一致的，在后台不管是saveToekn或resetToekn都可以防止这种情况
2、在一个请求正在处理insert时，再次点击insert按钮，如果使用isTokenValid(request,true)，意思是验证后就清空session Token,在验证以后如果新的请求过来肯定不会相等，因为当前session Toekn 为null

public class PrepareInsertAction extends Action {
	public ActionForward execute(ActionMapping mapping, ActionForm form,
			HttpServletRequest request, HttpServletResponse response) {
		saveToken(request);
		return mapping.findForward("inserttoken");
	}
}

public class InsertAction extends Action {
	public ActionForward execute(ActionMapping mapping, ActionForm form,
			HttpServletRequest request, HttpServletResponse response)
			throws Exception {
		//Toekn不相等,并清除session Token
		if (!isTokenValid(request,true)) {
                        //如果只能处理从PrepareInsertAction 过来的请求，可以把saveToken去掉
			saveToken(request);
			return (new ActionForward(mapping.getInput()));
		}else{
			//做剩余的工作
		}
		return mapping.findForward("list");
	}
}