防止表单重复提交

一、利用js，表单提交后马上使按钮失效

<input type="button" value="提交" onclick="this.disabled=true;this.form.submit()"> 

 
二、利用token防止表单重复提交

    Filter

package com.web;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang.ArrayUtils;

public class TokenRequestFilter implements Filter {
	   
    private String[] addUrls; // 需要增加 TOKEN 的页面  
    private String[] validUrls;// 需要验证TOEKN 的页面  
    private String processUrl; // TOKEN 验证失败处理的页面  
    FilterConfig filterConfig = null;  
    
    // 实例化 token 生成器  
    private TokenGenerator tokenGenerator = new SimpleTokenGenerator(); 
    

	public void destroy() {
		this.filterConfig = null;
	}

	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {
		// 获取请求路径  
        String path = getRelativePath((HttpServletRequest) request);  
        // 如果路径存在增加的urls列表里面，则向客户端增加一个token 参数  
        if (ArrayUtils.contains(addUrls, path)) {  
        	tokenGenerator.save((HttpServletRequest) request,  
                    (HttpServletResponse) response);  
        }  
        // 如果路径存在验证urls列表里面 这获取客户端 token 参数做验证  
        if (ArrayUtils.contains(validUrls, path)) {  
            if (!tokenGenerator.validate((HttpServletRequest) request,  
                    (HttpServletResponse) response)) {  
                // 验证没有通过则跳转到错误处理页面  
                ((HttpServletResponse) response)  
                        .sendRedirect(processUrl);  
                return;  
            }  
        }  
        // 到了这里说明验证已经通过，则将客户端 token 删除 下次提交客户端cookie token 为空 重复提交则失败  
        if (ArrayUtils.contains(validUrls, path)) {  
            tokenGenerator.remove((HttpServletRequest) request,  
                    (HttpServletResponse) response);  
        }  
        chain.doFilter(request, response);  
	}

	public void init(FilterConfig filterConfig) throws ServletException {
		String _splitChar = filterConfig.getInitParameter("splitChar");
		String _addUrls = filterConfig.getInitParameter("addUrls");
		String _validUrls = filterConfig.getInitParameter("validUrls");
		processUrl = filterConfig.getInitParameter("processUrl") ;
		filterConfig.getInitParameter("processUrl");
		if(null != _addUrls && "".equals(_addUrls)){
			addUrls = _addUrls.split(_splitChar);
		}
		if(null != _validUrls && "".equals(_validUrls)){
			validUrls = _validUrls.split(_splitChar);
		}
		
	}
	
	protected String getRelativePath(HttpServletRequest request) {   
		return request.getRequestURL().toString();

    }  

}

 Token接口

package com.web;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public interface TokenGenerator {
	  /** 
     * 增加 TOKEN  
     */  
    public String save(HttpServletRequest request, HttpServletResponse response);  
      
    /** 
     * 删除TOKEN 
     */  
    public void remove(HttpServletRequest request, HttpServletResponse response);  
      
    /** 
     * 验证TOKEN 是否有效 验证成功应当手动调用 remove 方法 手动从COOKIE中清除TOKEN 
     */  
    public boolean validate(HttpServletRequest request, HttpServletResponse response); 
}

 Token实现

package com.web;

import java.util.UUID;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang.StringUtils;

public class SimpleTokenGenerator implements TokenGenerator {

	 /** 
     * 默认TOOKEN 名称 
     */  
    private final static String FORM_TOEKN_NAME = "_form_token";  
  
    public boolean validate(HttpServletRequest request,  
            HttpServletResponse response) {  
        String paramString = request.getParameter(FORM_TOEKN_NAME);  
        if (StringUtils.isBlank(paramString)) {  
            return false;  
        }  
        String value = get(request);  
        if (StringUtils.isBlank(value)) {  
            return false;  
        }  
        return value.equals(paramString);  
    }  
  
    public String save(HttpServletRequest request, HttpServletResponse response) {  
        String value = StringUtils.remove(UUID.randomUUID().toString(), "-");  
        if (value != null) {  
            set(request, response, value);  
        }  
        return value;  
    }  
  
    public void remove(HttpServletRequest request, HttpServletResponse response) {  
        String value = get(request);  
        if (value != null) {  
            cancle(request, response);  
        }  
    }  
  
    /** 
     * 从cookie中获取TOKEN 
     *  
     * @param request 
     * @return 
     */  
    private String get(HttpServletRequest request) {  
        Cookie cookie = CookieUtils.getCookie(request, FORM_TOEKN_NAME);  
        return cookie == null ? null : cookie.getValue();  
    }  
  
    /** 
     * 设置 TOKEN 到 COOKIE 当中 
     *  
     * @param request 
     * @param response 
     * @param value 
     */  
    private void set(HttpServletRequest request, HttpServletResponse response,  
            String value) {  
        if (value != null) {  
            CookieUtils.addCookie(request, response, FORM_TOEKN_NAME, value,  
                    -1, null);  
        }  
        if (value != null) {  
            request.setAttribute(FORM_TOEKN_NAME, value);  
        }  
    }  
  
    /** 
     * 从COOKIE中清楚TOKEN 
     *  
     * @param request 
     * @param response 
     */  
    private void cancle(HttpServletRequest request, HttpServletResponse response) {  
        CookieUtils.cancleCookie(request, response, FORM_TOEKN_NAME, null);  
    }  
}

 CookieUtils

package com.web;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang.StringUtils;

public class CookieUtils {
	
    /** 
     * 获得cookie 
     *  
     * @param request 
     *            HttpServletRequest 
     * @param name 
     *            cookie name 
     * @return if exist return cookie, else return null. 
     */  
    public static Cookie getCookie(HttpServletRequest request, String name) {  
        Cookie[] cookies = request.getCookies();  
        if (cookies != null && cookies.length > 0) {  
            for (Cookie c : cookies) {  
                if (c.getName().equals(name)) {  
                    return c;  
                }  
            }  
        }  
        return null;  
    }  
  
    /** 
     * 根据部署路径，将cookie保存在根目录。 
     *  
     * @param request 
     * @param response 
     * @param name 
     * @param value 
     * @param expiry 
     * @param domain 
     * @return 
     */  
    public static Cookie addCookie(HttpServletRequest request,  
            HttpServletResponse response, String name, String value,  
            Integer expiry, String domain) {  
        Cookie cookie = new Cookie(name, value);  
        if (expiry != null) {  
            cookie.setMaxAge(expiry);  
        }  
        if (StringUtils.isNotBlank(domain)) {  
            cookie.setDomain(domain);  
        }  
        String ctx = request.getContextPath();  
        cookie.setPath(StringUtils.isBlank(ctx) ? "/" : ctx);  
        response.addCookie(cookie);  
        return cookie;  
    }  
  
    /** 
     * 取消cookie 
     *  
     * @param request 
     * @param response 
     * @param name 
     * @param domain 
     */  
    public static void cancleCookie(HttpServletRequest request,  
            HttpServletResponse response, String name, String domain) {  
        Cookie cookie = new Cookie(name, "");  
        cookie.setMaxAge(0);  
        String ctx = request.getContextPath();  
        cookie.setPath(StringUtils.isBlank(ctx) ? "/" : ctx);  
        if (StringUtils.isNotBlank(domain)) {  
            cookie.setDomain(domain);  
        }  
        response.addCookie(cookie);  
    }  
}

 XML配置

<filter>  
        <filter-name>tokenRequestFilter</filter-name>  
        <filter-class>com.web.TokenRequestFilter</filter-class>  
        <init-param>  
            <param-name>splitChar</param-name>  
            <param-value>@</param-value>  
        </init-param>  
        <init-param>  
            <param-name>addUrls</param-name>  
            <param-value>/member/forgot_password.html;/login.html</param-value>  
        </init-param>  
        <init-param>  
            <param-name>validUrls</param-name>  
            <param-value>/member/forgot_password.jhtml;/login.jhtml</param-value>  
        </init-param>  
        <init-param>  
            <param-name>processUrl</param-name>  
            <param-value>/member/tip.html</param-value>  
        </init-param>  
    </filter>  
  
    <filter-mapping>  
        <filter-name>tokenRequestFilter</filter-name>  
        <url-pattern>/*</url-pattern>  
    </filter-mapping>