Struts-利用Token解决重复提交

最新推荐文章于 2021-02-28 00:56:47 发布

xianqiang1

最新推荐文章于 2021-02-28 00:56:47 发布

阅读量1.3k

点赞数

CC 4.0 BY-SA版权

分类专栏： Struts1.3

本文链接：https://blog.youkuaiyun.com/lzqwebsoft/article/details/8099384

Struts1.3 专栏收录该内容

4 篇文章

订阅专栏

本文介绍如何使用Struts框架的Token机制防止Web表单重复提交，包括配置步骤、核心代码及运行示例。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

利用同步令牌(Token)机制可以解决Web应用中重复提交的问题，Struts通过org.apache.struts.action.Action类中提供的一系列和Token相关的方法给出一个参考实现：

1.protected boolean isTokenValid(javax.servlet.http.HttpServletRequset requset)

判断存储在当前用户会话中的令牌值和请求参数中的令牌值是否匹配。如果匹配，就返回true,否则返回false.只要符合以下情况之一，就会返回false:

不存在HttpSession对象
在session范围内没有保存令牌值
在请求参数中没有令牌值
存储在当前用户session范围内的令牌和请求参数的令牌值不匹配

2.protected void resetToken(javax.servlet.http.HttpServletRequest request)

从当前session范围内删除令牌属性。

3.protected void saveToken(javax.servlet.http.HttpServletRequest request)

创建一个新的令牌，并把它保存在当前session范围内，如果HttpSession对象不存在就首先创建一个HttpSession对象。

同时<html:form>标签的实现类org.apache.struts.taglib.html.FormTag的renderToken()方法判断在session范围内是否存在Token,如果存在，就在表单中生成一个包含Token信息的隐藏字段，也就是说我们直接使用Struts的表单标签<html:form>就行，不用手动的添加判断获取 session中的Token。

下面就一个小例子来详细的讲叙Struts中如何利用Token解决重复提交：

1,配置web.xml，装配Struts框架：

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">
  <display-name>Struts-Token</display-name>
  <welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
  </welcome-file-list>
  
  <servlet>
     <servlet-name>action</servlet-name>
     <servlet-class>org.apache.struts.action.ActionServlet</servlet-class>
     <init-param>
         <param-name>config</param-name>
         <param-value>/WEB-INF/struts-config.xml</param-value>
     </init-param>
     <load-on-startup>2</load-on-startup>
  </servlet>
  
  <servlet-mapping>
      <servlet-name>action</servlet-name>
      <url-pattern>*.do</url-pattern>
  </servlet-mapping>
</web-app>

2.编写欢迎页面index.jsp,实现首页跳转Action:

<%@ page language="java" contentType="text/html; charset=UTF-8"%>
<%@ taglib uri="http://struts.apache.org/tags-logic" prefix="logic" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Index</title>
</head>
<body>
   <logic:forward name="register" />
</body>
</html>

3.编写简单的注册页面/WEB-INF/register.jsp:

<%@ page language="java" contentType="text/html; charset=UTF-8"%>
<%@ taglib uri="http://struts.apache.org/tags-html" prefix="html" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>注册用户</title>
</head>
<body>
    <html:errors />
    
    <html:form action="/registerHandle">
                  名称：<html:text property="username" size="16" maxlength="16" /><br />
       <html:submit property="submit" value="提交" />
    </html:form>
</body>
</html>

使用Struts的<html:form>表单标签，则当跳转到此页面时自动添加如下保存Token的隐藏域：

<form name="registerForm" method="post" action="/Struts-Token/registerHandle.do">
    <div>
      <input type="hidden" name="org.apache.struts.taglib.html.TOKEN"
             value="7547cacf09a2da6ba3717fd55185329a">
    </div>
    名称：<input type="text" name="username" maxlength="16" size="16" value=""><br />
    <input type="submit" name="submit" value="提交">
</form>

4.编写注册成功页面/WEB-INF/success.jsp:

<%@ page language="java" contentType="text/html; charset=UTF-8" %>
<%@ taglib uri="http://struts.apache.org/tags-bean" prefix="bean" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>注册成功</title>
</head>
<body>
    <bean:write name="username" />注册成功！
</body>
</html>

5.编写封装注册信息的Action Form,RegisterForm.java：

package test.form;

import org.apache.struts.action.ActionForm;

public class RegisterForm extends ActionForm {
	private static final long serialVersionUID = 1L;
	
	private String username;
	
	public String getUsername() {
		return username;
	}
	public void setUsername(String username) {
		this.username = username;
	}
}

6.编写注册跳转Action,PrepareRegisterAction.java:

package test.action;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.struts.action.Action;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;

public class PrepareRegisterAction extends Action {

	@Override
	public ActionForward execute(ActionMapping mapping, ActionForm form,
			HttpServletRequest request, HttpServletResponse response)
			throws Exception {
		saveToken(request);
		return mapping.findForward("success");
	}

}

7.编写注册提交处理Action,RegisterHandleAction.java：

package test.action;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.struts.action.Action;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.action.ActionMessage;
import org.apache.struts.action.ActionMessages;

import test.form.RegisterForm;

public class RegisterHandleAction extends Action {

	@Override
	public ActionForward execute(ActionMapping mapping, ActionForm form,
			HttpServletRequest request, HttpServletResponse response)
			throws Exception {
		ActionMessages errors = new ActionMessages();
		if(!isTokenValid(request)) {
			errors.add(ActionMessages.GLOBAL_MESSAGE, 
					new ActionMessage("error.invalid.token"));
			saveErrors(request, errors);
			saveToken(request);
			return (new ActionForward(mapping.getInput()));
		} else {
			resetToken(request);
		}
		request.setAttribute("username", ((RegisterForm)form).getUsername());
		// insert the record to database
		// .....
		return mapping.findForward("success");
	}

}

8.添加错误信息提示的资源文件application.properties：

error.invalid.token=<i>不能重复提交表单！</i>

9.编写Struts的配置文件struts-config.xml：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE struts-config PUBLIC
       "-//Apache Software Foundation//DTD Struts Configuration 1.3//EN"
       "http://struts.apache.org/dtds/struts-config_1_3.dtd">
<struts-config>
   <form-beans>
       <form-bean name="registerForm" type="test.form.RegisterForm" />
   </form-beans>

   <global-forwards>
       <forward name="register" path="register.do" />
   </global-forwards>
   
   <action-mappings>
        <action path="/register"
            type="test.action.PrepareRegisterAction"
            scope="request" name="registerForm" >
           <forward name="success" path="/WEB-INF/register.jsp" />
        </action>
            
        <action path="/registerHandle"
            type="test.action.RegisterHandleAction"
            scope="request" name="registerForm"
            validate="true" input="/register.do">
           <forward name="success" path="/WEB-INF/success.jsp" />
        </action>
   </action-mappings>
   
   <message-resources parameter="application" />  
</struts-config>