Token注解防止表单的重复提交

注解的一些基础：

参见http://blog.csdn.net/duo2005duo/article/details/50505884和

http://blog.csdn.net/duo2005duo/article/details/50511476这两篇文章

1，自定义一个注解@Token 用来标记需要防止重复提交的方法

 package com.bjca.framework.util;
 /**
  * <p>
 *关于这个方法的用法是：
 *在需要生成token的controller上增加@Token(save=true)，
 *而在需要检查重复提交的controller上添加@Token(remove=true)就可以了
 *另外，你需要在view里在form里增加下面代码：
 *<input type="hidden" name="token" value="${token}">
  * 此时会在拦截器中验证是否重复提交
  * </p>
  *
  */
 import java.lang.annotation.*;
 
 @Target(ElementType.METHOD)
 @Retention (RetentionPolicy.RUNTIME)
 public @interface Token {
 
      boolean save() default false ;
 
      boolean remove() default false ;
 }

2，自定义一个针对该注解的拦截器 TokenInterceptor

 package com.bjca.framework.util;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.web.method.HandlerMethod;
 import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.lang.reflect.Method;
 import java.util.UUID;
 
 public class TokenInterceptor extends HandlerInterceptorAdapter {
     public static Log log = LogFactory.getLog(TokenInterceptor.class);
      @Override
      public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
           System.out.println(handler.getClass());
          if (handler instanceof HandlerMethod) {
              HandlerMethod handlerMethod = (HandlerMethod) handler;
              Method method = handlerMethod.getMethod();
              Token annotation = method.getAnnotation(Token. class );
 
              if (annotation != null ) {
                  boolean needSaveSession = annotation.save();
                  if (needSaveSession) {
                      String uuid=UUID.randomUUID().toString();
                         log.debug("提交生成除令牌"+uuid);
                      request.getSession( false ).setAttribute( "token" , uuid);
                  }
                  boolean needRemoveSession = annotation.remove();
                  if (needRemoveSession) {
                      if (isRepeatSubmit(request)) {
                          return false ;
                      }
                      log.debug("提交移除令牌"+request.getSession().getAttribute("token" ));
                      request.getSession( false ).removeAttribute( "token" );
                  }
              }
              return true ;
          } else {
              return super .preHandle(request, response, handler);
          }
      }
 
      private boolean isRepeatSubmit(HttpServletRequest request) {
          String serverToken = (String) request.getSession( false ).getAttribute( "token" );
          if (serverToken == null ) {
              return true ;
          }
          String clinetToken = request.getParameter( "token" );
          if (clinetToken == null ) {
              return true ;
          }
          if (!serverToken.equals(clinetToken)) {
              return true ;
          }
          return false ;
      }
 }

3,在spring MVC的配置文件里注册该拦截器

 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
     xmlns:mvc="http://www.springframework.org/schema/mvc"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xmlns:p="http://www.springframework.org/schema/p"
     xmlns:context="http://www.springframework.org/schema/context"
     xsi:schemaLocation="http://www.springframework.org/schema/beans
         http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
         http://www.springframework.org/schema/context
         http://www.springframework.org/schema/context/spring-context-4.0.xsd
         http://www.springframework.org/schema/mvc
         http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd"
     >
     <!-- 对spring org.lxh包下所有注解扫描 -->
     <context:component-scan base-package="com.xxx">
         <context:exclude-filter type="annotation"  expression="org.springframework.stereotype.Repository" />
     </context:component-scan>
     <!-- 支持spring mvc新的注解类型 详细spring3.0手册 15.12.1 mvc:annotation-driven-->
     <mvc:annotation-driven />
 
     <bean  id="viewResolver"
             class="org.springframework.web.servlet.view.InternalResourceViewResolver">
             <!-- 为了使用JSTL Tag修改默认的viewClass属性 -->
             <property
                   name="viewClass"
                   value="org.springframework.web.servlet.view.JstlView" />
             <property
                   name="prefix"
                   value="/WEB-INF/views/" />
             <property
                   name="suffix"
                   value=".jsp"></property>
             <property
                   name="order"
                   value="1"></property>
         </bean>
    <!-- 拦截器 -->
     <mvc:interceptors>
        <!-- 用户登录拦截 -->
         <bean class="com.xx.xxx.filter.StageSecurityInterceptor">
             <property name="patterns" >
                 <list>
                     <value>.*/console/.*\.jhtml</value>
                     <value>.*/center/.*\.jhtml</value>
 
                 </list>
             </property>
             <property name="loginView">
                 <value>/manage.jsp</value>
             </property>
         </bean>
54          <!-- 配置Token拦截器，防止用户重复提交数据 -->
55         <mvc:interceptor>
56             <mvc:mapping path="/**"/>
57             <bean class="com.xxx.framework.util.TokenInterceptor"/>
58         </mvc:interceptor>
     </mvc:interceptors>
     <!--
      <bean id="viewResolver"
           class="org.springframework.web.servlet.view.ResourceBundleViewResolver">
         <property name="basenames">
             <list>
                 <value>views-stage</value>
             </list>
         </property>
     </bean>
     -->
 </beans>

4，演示demo

4.1，在跳转至某个需要加上@Token(save = true)

1     @RequestMapping("/personalForm.jhtml")
2　　　@Token(save = true)
     public String personalForm(HttpServletRequest request, HttpServletResponse response, ModelMap modelMap) {
         Account account = Account.sessionAccount();
         if (account == null) {
             return "redirect:/login.jsp";
         }
     　　//..........业务..............
 　　}    

4.2，在上个Controller 跳转的方法上加入${Token}

 <div class="main clearfix nav center regist copyright_main5">
         <h3 class="registTitle">填写身份信息</h3>
         <img alt="" src="<c:url value='/platform/stage/image/regist/wave.png'/>"><br /> <img src="<c:url value='/platform/stage/image/portals/regist-info.png'/>"></img>
         <c:if test="${personalInfoForm.checkState eq 2}">
         <br/>
         <div>
         <font color="red" size="2"><span>身份认证意见:${personalInfoForm.checkOpnion}</span></font>
         </div>
         </c:if>
         <form autocomplete="off" style="margin: 0;" id="form1" method="post" name="personalInfoForm" action="<c:url value='/center/member/savePersonalInfo.jhtml'/>" enctype="multipart/form-data">
             <input type="hidden" value="${personalInfoForm.id}" name="id" />
             <input type="hidden" name="token" value="${token}">             

4.3，在表单提交方法的地方加上注解 @Token(remove = true)

 @RequestMapping(value = "/savePersonalInfo.jhtml", method = {RequestMethod.POST})
     @Token(remove = true)
     public String savePersonalInfo(HttpServletRequest request, HttpServletResponse response, ModelMap modelMap, PersonalInfo personalInfoForm) throws Exception {
         DateFormat fm = new SimpleDateFormat("yyyy-MM-dd");
         Date birthday = fm.parse(request.getParameter("birthday2"));
         personalInfoForm.setBirthday(birthday);
 
         Account account = Account.sessionAccount();
         if(account==null){
             return "redirect:/login.jsp";
         }
     //.....................业务.........................
 }    

5，完成了。