Synchronizer token and JSF

Question

Hello,
I am just wondering if JSF offers a synchronizer token feature in order to avoid multiple form submissions.
Thanks in advance,
Albert Steed.

Answer 1

Here's how I've implemented a token synchronizer pattern in my web app.
This example has a session-scope Visit object and request-scope RequestBean:
  <managed-bean>
    <description>Session bean that holds data and delegates needed by request beans.</description>
    <managed-bean-name>visit</managed-bean-name>
    <managed-bean-class>com.example.Visit</managed-bean-class>
    <managed-bean-scope>session</managed-bean-scope>
  </managed-bean>
  <managed-bean>
    <description>Some request bean.</description>
    <managed-bean-name>reqBean</managed-bean-name>
    <managed-bean-class>com.example.RequestBean</managed-bean-class>
    <managed-bean-scope>request</managed-bean-scope>
    <managed-property>
      <property-name>visit</property-name>
      <value>#{sessionScope.visit}</value>
    </managed-property>
  </managed-bean>My Visit class has the following:
    private long activeToken;
    private long receivedToken;
     * This returns the active save token.  Note that this is not the same
     * variable that is set by the setSaveToken() method.  This is so we can put a
     * tag in a JSP:<br/>
     *   <h:inputHidden value="#{visit.saveToken}" /> <br/>
     * That will retrieve the active token from Visit when the page
     * is rendered, and when the page is returned, setSaveToken() sets the
     * received token.  The tokens can then be compared to see if a save
     * should be performed.  See BaseBean.generateToken() for more details.
     * @return Returns the active save token.
    public long getSaveToken() {
        return this.activeToken;
     * Sets the received token.  Note that this method is only intended to be
     * called by a JSF EL expression such as: <br/>
     *   <h:inputHidden value="#{visit.saveToken}" /> <br/>
     * See getSaveToken() for more details on why.
     * @param received token value to set
    public void setSaveToken(long aToken) {
        this.receivedToken = aToken;
    void setReceivedToken(long aToken) {
        this.receivedToken = aToken;
    long getReceivedToken() {
        return this.receivedToken;
    void setActiveToken(long aToken) {
        this.activeToken = aToken;
    long getActiveToken() {
        return this.activeToken;
     * @return true if the active and received token are both non-zero and they match
    boolean tokensMatchAndAreNonZero() {
        return (this.activeToken != 0) && (this.receivedToken != 0) && (this.activeToken == this.receivedToken);
. . .My backing beans extend a base class BaseBean with these methods:
     * Generates a new save token, saving it to a field in Visit. Guaranteed to not
     * generate a 0 (0 is used to denote an expired token).<br/><br/>
     * This token is used to make sure that
     * actions that modify data in a way that should not be immediately repeated.
     * Call this method prior to rendering a page that will submit the non-repeatable
     * request.  Then before saving any data, call saveTokenIsInvalid() to see if the
     * save should be executed.  If the token is valid, expire it and proceed with
     * saving.<br/>
     * The view that submits an unrepeatable request should have the tag:<br/>
     *      <h:inputHidden value="#{visit.saveToken}" /><br/>
     * in it.  Visit.getSaveToken() will set this field with the active token when the
     * page is rendered.  Visit.setSaveToken() will set a received token field, which
     * can then be compared to the active token to find out whether a save should be
     * performed.
    protected void generateSaveToken() {
        logger.debug("generateSaveToken()");
        Random random = new Random();
        long token = random.nextLong();
        while (token == 0) {
            token = random.nextLong();
        this.getVisit().setActiveToken(token);
        this.getVisit().setReceivedToken(0);
     * Checks the save token to see if it is valid.
     * @true if the save token is invalid.  It is invalid if either the received or the active
     * tokens in Visit are zero, or if the tokens do not match.
    protected boolean saveTokenIsInvalid() {
        if (logger.isDebugEnabled() ) {
            logger.debug("saveTokenIsInvalid():\nactive token: " + this.getVisit().getActiveToken() + "\nrecv'd token: " + this.getVisit().getReceivedToken() );
        boolean isValid = this.getVisit().tokensMatchAndAreNonZero();
        // return the inverse because this method is called "saveTokenIsInvalid"
        return !isValid;
     * Sets active token to zero, preventing any saves by methods that check for valid save token
     * before committing a change until generateSaveToken() is called again.
    protected void expireSaveToken() {
        logger.debug("expireSaveToken()");
        this.getVisit().setActiveToken(0);
     * Logs an info message saying that a save action was not performed because of invalid save
     * token.  Returns given String as outcome.
     * @param logger for subclass calling this method
     * @param outcome
     * @return outcome
    protected String logInvalidSaveAndReturn(Logger subclassLogger, String outcome) {
        if (subclassLogger.isInfoEnabled() ) {
            subclassLogger.info("User " + this.getVisit().getUsername() + " submitted a save request that was not " +
                    "processed because the save token was not valid.  Returning outcome: '" + outcome + "'.");
        return outcome;
    // Used by JSF managed bean creation facility
    public Visit getVisit() {
        return this.visit;
    // Used by JSF managed bean creation facility
    public void setVisit(Visit visit) {
        this.visit = visit;
. . .Any method that sets up a view containing a form I only want submitted once generates a token:
       this.generateSaveToken();And the token gets embedded in the HTML form with the tag:
<h:inputHidden value="#{visit.saveToken}" />An action method in RequestBean would then use the token to prevent multiple identical saves as follows:
    public String someActionMethod() {
        // prevent identical requests from being processed
        String normalOutcome = Constants.NavOutcome.OK;
        if (this.saveTokenIsInvalid() ) {
            return this.logInvalidSaveAndReturn(logger, normalOutcome);
        this.expireSaveToken();
        logger.debug("save token is valid.  attempting to save....");
        try {
              // invoke some business logic here
        } catch (MyException exc) {
              // important: if you are returning the user to the same form view with an error message,
              // and want to be able to process subsequent form submissions, then the token
              // needs to be regenerated
              this.generateSaveToken();
              return null;
. . .It has worked great so far. The only problems I've had are when I forget to generate or expire a token, or I forget to embed it in my form.
I also had a problem where I expired the token after my business logic completed, and my business logic took about 30-60 seconds to process--if the user clicks on the submit button several times while waiting for the page to return, the backing bean method still sees a valid token and processes the request. This was solved by simply expiring the token prior to invoking the business logic (as shown in the above example).
HTH,
Scott