Token注解防止表单的重复提交

注解的一些基础：

参见http://blog.csdn.net/duo2005duo/article/details/50505884和

http://blog.csdn.net/duo2005duo/article/details/50511476这两篇文章

1，自定义一个注解@Token 用来标记需要防止重复提交的方法

package com.bjca.framework.util;
/**
 * <p>
*关于这个方法的用法是：
*在需要生成token的controller上增加@Token(save=true)，
*而在需要检查重复提交的controller上添加@Token(remove=true)就可以了
*另外，你需要在view里在form里增加下面代码：
*<input type="hidden" name="token" value="${token}">
 * 此时会在拦截器中验证是否重复提交
 * </p>
 *
 */
import java.lang.annotation.*;

@Target(ElementType.METHOD)
@Retention (RetentionPolicy.RUNTIME)
public @interface Token {
 
     boolean save() default false ;
 
     boolean remove() default false ;
}

 

2，自定义一个针对该注解的拦截器 TokenInterceptor 

package com.bjca.framework.util;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Method;
import java.util.UUID;

public class TokenInterceptor extends HandlerInterceptorAdapter {
    public static Log log = LogFactory.getLog(TokenInterceptor.class);
     @Override
     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
          System.out.println(handler.getClass());
         if (handler instanceof HandlerMethod) {
             HandlerMethod handlerMethod = (HandlerMethod) handler;
             Method method = handlerMethod.getMethod();
             Token annotation = method.getAnnotation(Token. class );
           
             if (annotation != null ) {
                 boolean needSaveSession = annotation.save();
                 if (needSaveSession) {
                     String uuid=UUID.randomUUID().toString();
                        log.debug("提交生成除令牌"+uuid);
                     request.getSession( false ).setAttribute( "token" , uuid);
                 }
                 boolean needRemoveSession = annotation.remove();
                 if (needRemoveSession) {
                     if (isRepeatSubmit(request)) {
                         return false ;
                     }
                     log.debug("提交移除令牌"+request.getSession().getAttribute("token" ));
                     request.getSession( false ).removeAttribute( "token" );
                 }
             }
             return true ;
         } else {
             return super .preHandle(request, response, handler);
         }
     }
 
     private boolean isRepeatSubmit(HttpServletRequest request) {
         String serverToken = (String) request.getSession( false ).getAttribute( "token" );
         if (serverToken == null ) {
             return true ;
         }
         String clinetToken = request.getParameter( "token" );
         if (clinetToken == null ) {
             return true ;
         }
         if (!serverToken.equals(clinetToken)) {
             return true ;
         }
         return false ;
     }
}

3,在spring MVC的配置文件里注册该拦截器

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:mvc="http://www.springframework.org/schema/mvc" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:p="http://www.springframework.org/schema/p" 
    xmlns:context="http://www.springframework.org/schema/context"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-4.0.xsd 
        http://www.springframework.org/schema/context 
        http://www.springframework.org/schema/context/spring-context-4.0.xsd 
        http://www.springframework.org/schema/mvc 
        http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd"
    >
    <!-- 对spring org.lxh包下所有注解扫描 -->
    <context:component-scan base-package="com.xxx">
        <context:exclude-filter type="annotation"  expression="org.springframework.stereotype.Repository" />
    </context:component-scan>
    <!-- 支持spring mvc新的注解类型 详细spring3.0手册 15.12.1 mvc:annotation-driven-->
    <mvc:annotation-driven />
    
    <bean  id="viewResolver"
            class="org.springframework.web.servlet.view.InternalResourceViewResolver">
            <!-- 为了使用JSTL Tag修改默认的viewClass属性 -->
            <property
                  name="viewClass"
                  value="org.springframework.web.servlet.view.JstlView" />
            <property
                  name="prefix"
                  value="/WEB-INF/views/" />
            <property
                  name="suffix"
                  value=".jsp"></property>
            <property
                  name="order"
                  value="1"></property>
        </bean>
   <!-- 拦截器 -->
    <mvc:interceptors>
       <!-- 用户登录拦截 -->
        <bean class="com.xx.xxx.filter.StageSecurityInterceptor">
            <property name="patterns" >
                <list>
                    <value>.*/console/.*\.jhtml</value>
                    <value>.*/center/.*\.jhtml</value>
                  
                </list>
            </property>
            <property name="loginView">
                <value>/manage.jsp</value>
            </property>
        </bean>
54          <!-- 配置Token拦截器，防止用户重复提交数据 -->
55         <mvc:interceptor>
56             <mvc:mapping path="/**"/>
57             <bean class="com.xxx.framework.util.TokenInterceptor"/>
58         </mvc:interceptor>
    </mvc:interceptors>
    <!--  
     <bean id="viewResolver"
          class="org.springframework.web.servlet.view.ResourceBundleViewResolver">
        <property name="basenames">
            <list>
                <value>views-stage</value>
            </list>
        </property>
    </bean>
    -->
</beans>

 4，演示demo

4.1，在跳转至某个需要加上@Token(save = true)

1     @RequestMapping("/personalForm.jhtml")
2　　　@Token(save = true)
    public String personalForm(HttpServletRequest request, HttpServletResponse response, ModelMap modelMap) {
        Account account = Account.sessionAccount();
        if (account == null) {
            return "redirect:/login.jsp";
        }
    　　//..........业务..............
　　}    

 

 4.2，在上个Controller 跳转的方法上加入${Token} 

<div class="main clearfix nav center regist copyright_main5">
        <h3 class="registTitle">填写身份信息</h3>
        <img alt="" src="<c:url value='/platform/stage/image/regist/wave.png'/>"><br /> <img src="<c:url value='/platform/stage/image/portals/regist-info.png'/>"></img>
        <c:if test="${personalInfoForm.checkState eq 2}">
        <br/>
        <div>
        <font color="red" size="2"><span>身份认证意见:${personalInfoForm.checkOpnion}</span></font>
        </div>
        </c:if>
        <form autocomplete="off" style="margin: 0;" id="form1" method="post" name="personalInfoForm" action="<c:url value='/center/member/savePersonalInfo.jhtml'/>" enctype="multipart/form-data">
            <input type="hidden" value="${personalInfoForm.id}" name="id" />
            <input type="hidden" name="token" value="${token}">             

 4.3，在表单提交方法的地方加上注解 @Token(remove = true)

@RequestMapping(value = "/savePersonalInfo.jhtml", method = {RequestMethod.POST})
    @Token(remove = true)
    public String savePersonalInfo(HttpServletRequest request, HttpServletResponse response, ModelMap modelMap, PersonalInfo personalInfoForm) throws Exception {
        DateFormat fm = new SimpleDateFormat("yyyy-MM-dd");
        Date birthday = fm.parse(request.getParameter("birthday2"));
        personalInfoForm.setBirthday(birthday);
      
        Account account = Account.sessionAccount();
        if(account==null){
            return "redirect:/login.jsp";
        }
    //.....................业务.........................
}    

 5，完成了。