使用token是為了防止重復提交,像灌水之類的.
LoginAction:
package com.web.action;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.actions.DispatchAction;
public class LoginAction extends DispatchAction 
{
public ActionForward get(ActionMapping mapping, ActionForm form,
HttpServletRequest request, HttpServletResponse response)
throws Exception {
//保存令牌(保存在jsp動態生成的32位jsessionid)\
this.saveToken(request);
System.out.println("begin save");
return mapping.findForward("login");
}
public ActionForward login(ActionMapping mapping, ActionForm form,
HttpServletRequest request, HttpServletResponse response)
throws Exception {
/**//*if(this.isTokenValid(request))
{
System.out.println("valid");
this.resetToken(request);
return mapping.findForward("ok");
}*/
//這個寫法和上面注釋部分一樣效果
if(this.isTokenValid(request,true))
{
System.out.println("valid");
return mapping.findForward("ok");
}
else
{
System.out.println("invalid");
return mapping.findForward("error");
}
}
}
struts-config.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE struts-config PUBLIC "-//Apache Software Foundation//DTD Struts Configuration 1.2//EN" "http://struts.apache.org/dtds/struts-config_1_2.dtd">
<struts-config>
<data-sources />
<form-beans>
<form-bean name="loginForm" type="com.web.form.LoginForm"></form-bean>
</form-beans>
<global-exceptions />
<global-forwards />
<action-mappings>
<action path="/login" parameter="method" name="loginForm"
type="com.web.action.LoginAction">
<forward name="login" path="/login.jsp" />
<forward name="ok" path="/ok.jsp" />
<forward name="error" path="/error.jsp" />
</action>
</action-mappings>
<message-resources parameter="" />
</struts-config>
index.jsp:
<%@page contentType="text/html; charset=GBK"%>
<%@taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
<c:set var="ctx" value="${pageContext.request.contextPath}" />
<html>
<head>
<title>My Jsp</title>
</head>
<body>
<a href="${ctx}/login.do?method=get">發言</a>
</body>
</html>
login.jsp:
<%@page contentType="text/html; charset=GBK"%>
<%@taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
<%@taglib uri="http://jakarta.apache.org/struts/tags-html" prefix="html" %>
<html>
<head>
<title>My Jsp</title>
</head>
<body>
<c:set var="ctx" value="${pageContext.request.contextPath}"/>
<!-- 此處必須使用html標簽,否則token不能用 -->
<html:form action="login.do?method=login" method="post">
<html:submit value="提交"></html:submit>
</html:form>
</body>
</html>
當你運行第一次的時候,會提示你"成功".
這時我們退到login.jsp查看一下源代碼:
<html>
<head>
<title>My Jsp</title>
</head>
<body>
<form name="loginForm" method="post" action="/strutsToken/login.do?method=login">
<div><input type="hidden" name="org.apache.struts.taglib.html.TOKEN" value="d7484f95247cf242a6f35107a1c7ac25"></div>
<input type="submit" value="提交">
</form>
</body>
</html>
對比一下我們寫的login.jsp多了一個隱藏域:
<div><input type="hidden" name="org.apache.struts.taglib.html.TOKEN" value="d7484f95247cf242a6f35107a1c7ac25"></div>
此時生成了一個32位的唯一的JsessionID做為值.
與LoginAction中的get方法的saveToken(request)是一樣的.
此句的作用就是把一個jsessionid保存到request范圍里.
在我們后退重新調用:
if(this.isTokenValid(request,true))
{
System.out.println("valid");
return mapping.findForward("ok");
}
時,就會拿login.jsp里傳過來的jsessionid和request的
進行比較,如果一樣,說明不合法.因為我們的操作都是在一個請求會話里
操作的.說明你在重復提交.
如果不一樣,說明重新生成了一個唯一的jsessionid(新開一個瀏覽器),
開啟了一個新會話,重新提交,這是合法的.
這樣就防止了表單重復提交問題.
源碼下載