（1）包含有Form表单得页面必须通过一个服务器程序动态生成，服务器程序为每次产生得页面中的form表单都分配一个唯一得随机标识号，并在form表单得一个隐藏域 保存
（2）当用户提交form得时候，负责接受这一请求得服务器程序比较form表单隐藏字段中的标识号与存贮在session中的是否相同，当下列情情况时候，服务器程序将忽略提交请求：
a.当前用户session不存在表单标识
b.用户提交得表单数据并没有标识号字段
c.存贮在当前用户的session中得标识号与表单数据中的不同
importjava.security.MessageDigest;importjava.security.NoSuchAlgorithmException;importjavax.servlet.http.HttpServletRequest;importjavax.servlet.http.HttpSession;
publicclassTokenProcessor...{
privatelongprivious;//上次生成表单标识号得时间值privatestaticTokenProcessorinstance=newTokenProcessor();publicstaticStringFORM_TOKEN_KEY="FORM_TOKEN_KEY";
privateTokenProcessor()...{
}publicstaticTokenProcessorgetInstance()...{returninstance;}/**//**验证请求中得标识号是否有效，如果请求中的表单标识与当前用户session中的相同，返回结果true=*/publicsynchronizedbooleanisTokenValid(HttpServletRequestrequest)...{//未避免session对象不存在时候创建Session对象HttpSessionsession=request.getSession(false);if(session==null)...{returnfalse;}Stringsaved=(String)session.getAttribute(FORM_TOKEN_KEY);if(saved==null)...{returnfalse;}Stringtoken=(String)request.getParameter(FORM_TOKEN_KEY);if(token==null)...{returnfalse;}returnsaved.equals(token);}/**//**清楚存储在当前用户session中的表单标识号*/publicsynchronizedvoidreset(HttpServletRequestrequest)...{HttpSessionsession=request.getSession(false);if(session==null)...{return;}session.removeAttribute(FORM_TOKEN_KEY);}/**//**产生表单标识号并将之保存在当前用户得session中*/publicsynchronizedvoidsaveToken(HttpServletRequestrequest)...{HttpSessionsession=request.getSession();try...{byteid[]=session.getId().getBytes();longcurrent=System.currentTimeMillis();if(current==privious)...{current++;}privious=current;bytenow[]=String.valueOf(current).getBytes();MessageDigestmd=MessageDigest.getInstance("MD5");md.update(id);md.update(now);Stringtoken=toHex(md.digest());session.setAttribute(FORM_TOKEN_KEY,token);}catch(NoSuchAlgorithmExceptione)...{}}/**//**将一个字节数转换成十六进制得字符串**/publicStringtoHex(bytebuffer[])...{StringBuffersb=newStringBuffer(buffer.length*2);for(inti=0;i<buffer.length;i++)...{sb.append(Character.forDigit((buffer[i]&0x60)>>4,16));sb.append(Character.forDigit(buffer[i]&0x0f,16));}returnsb.toString();}
}
importjava.io.IOException;importjava.io.PrintWriter;importjavax.servlet.ServletException;importjavax.servlet.http.HttpServlet;importjavax.servlet.http.HttpServletRequest;importjavax.servlet.http.HttpServletResponse;publicclassFormDoubleServletextendsHttpServlet...{protectedvoidservice(HttpServletRequestrequest,HttpServletResponseresponse)throwsServletException,IOException...{response.setContentType("text/html;charset=gb2312");PrintWriterout=response.getWriter();TokenProcessortokemProcessor=TokenProcessor.getInstance();if(!tokemProcessor.isTokenValid(request))...{out.println("重复提交");}Stringp1=request.getParameter("p");if(p1==null||p1.trim().equals(""))...{out.println("请输入内容");}else...{out.println("提交内容被处理");tokemProcessor.reset(request);//清楚session中的标识}}}
<%...@pagecontentType="text/html;charset=GBK"%><%...TokenProcessortokemProcessor=TokenProcessor.getInstance();
tokemProcessor.saveToken(request);
Stringtoken=(String)request.getSession().getAttribute(tokemProcessor.FORM_TOKEN_KEY);
%>
<html>
<head>
<title>用户登陆</title>
</head>
<body>
<formaction="/testServlet"method="post">
<inputname="<%=tokemProcessor.FORM_TOKEN_KEY%>"value="<%=token%>">
<inputname="q"/>
<inputtype="submit"value="submit"/>
</form>
</body>
</html>
Stringtoken=(String)request.getSession().getAttribute(tokemProcessor.FORM_TOKEN_KEY);%><html><head><title>用户登陆</title></head><body><formaction="/testServlet"method="post"><inputname="<%=tokemProcessor.FORM_TOKEN_KEY%>"value="<%=token%>"><inputname="q"/><inputtype="submit"value="submit"/></form></body></html>
版权声明：本文为博主原创文章，未经博主允许不得转载。
扫一扫
1836
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
