Preventing sensitive form re-submission

Question

I want to prevent the refresh/re-submission of form on the server side(not using javascript).There is some way of using tokens in session and request to validate the request from the client.But I am not very sure how to go about it.Can anyone elaborate the same for me..Thanks in advance....

Answer 1

You're on the right track. To use tokens, there should be a number stored in the session, and that same number placed in a hidden field in the form.
Before serving the form, create a unique key - new Date().getTime() gives you a long with millisecond precision. Store that number in the session and also place it in a hidden field in the form. When the form is submitted, check the hidden against the number in the session. If they match, the form submission is valid; remove the key and process the form. If the user tries to submit the same form by using the "back" button, the number in the form no longer has a match in the session, and you reject the form submission.
example:
in the jsp that generates the form:
<%
   // create a number unique to the current millisecond
    long key = new java.util.Date().getTime();
    // place it in the session to be looked up later
    session.setAttribute( "formKey", Long.toString( key )  );
%>
<form>
    <!-- put the form key in the form -->
    <input type="hidden" name="formKey" value="<%= key %>">
</form>in the code that processes the form:
String key = request.getParameter( "formKey" )
String sessionKey = (String)session.getAttribute( "formKey" );
if ( key.equals( sessionKey ) ){
    // process the form
} else {
    // key is not valid - send some error message
}