使用token是為了防止重復(fù)提交,像灌水之類的.
LoginAction:
package com.web.action;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.actions.DispatchAction;
public class LoginAction extends DispatchAction 
{
public ActionForward get(ActionMapping mapping, ActionForm form,
HttpServletRequest request, HttpServletResponse response)
throws Exception {
//保存令牌(保存在jsp動(dòng)態(tài)生成的32位jsessionid)\
this.saveToken(request);
System.out.println("begin save");
return mapping.findForward("login");
}
public ActionForward login(ActionMapping mapping, ActionForm form,
HttpServletRequest request, HttpServletResponse response)
throws Exception {
/**//*if(this.isTokenValid(request))
{
System.out.println("valid");
this.resetToken(request);
return mapping.findForward("ok");
}*/
//這個(gè)寫法和上面注釋部分一樣效果
if(this.isTokenValid(request,true))
{
System.out.println("valid");
return mapping.findForward("ok");
}
else
{
System.out.println("invalid");
return mapping.findForward("error");
}
}
}
struts-config.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE struts-config PUBLIC "-//Apache Software Foundation//DTD Struts Configuration 1.2//EN" "http://struts.apache.org/dtds/struts-config_1_2.dtd">
<struts-config>
<data-sources />
<form-beans>
<form-bean name="loginForm" type="com.web.form.LoginForm"></form-bean>
</form-beans>
<global-exceptions />
<global-forwards />
<action-mappings>
<action path="/login" parameter="method" name="loginForm"
type="com.web.action.LoginAction">
<forward name="login" path="/login.jsp" />
<forward name="ok" path="/ok.jsp" />
<forward name="error" path="/error.jsp" />
</action>
</action-mappings>
<message-resources parameter="" />
</struts-config>
index.jsp:
<%@page contentType="text/html; charset=GBK"%>
<%@taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
<c:set var="ctx" value="${pageContext.request.contextPath}" />
<html>
<head>
<title>My Jsp</title>
</head>
<body>
<a href="${ctx}/login.do?method=get">發(fā)言</a>
</body>
</html>
login.jsp:
<%@page contentType="text/html; charset=GBK"%>
<%@taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
<%@taglib uri="http://jakarta.apache.org/struts/tags-html" prefix="html" %>
<html>
<head>
<title>My Jsp</title>
</head>
<body>
<c:set var="ctx" value="${pageContext.request.contextPath}"/>
<!-- 此處必須使用html標(biāo)簽,否則token不能用 -->
<html:form action="login.do?method=login" method="post">
<html:submit value="提交"></html:submit>
</html:form>
</body>
</html>
當(dāng)你運(yùn)行第一次的時(shí)候,會(huì)提示你"成功".
這時(shí)我們退到login.jsp查看一下源代碼:
<html>
<head>
<title>My Jsp</title>
</head>
<body>
<form name="loginForm" method="post" action="/strutsToken/login.do?method=login">
<div><input type="hidden" name="org.apache.struts.taglib.html.TOKEN" value="d7484f95247cf242a6f35107a1c7ac25"></div>
<input type="submit" value="提交">
</form>
</body>
</html>
對(duì)比一下我們寫的login.jsp多了一個(gè)隱藏域:
<div><input type="hidden" name="org.apache.struts.taglib.html.TOKEN" value="d7484f95247cf242a6f35107a1c7ac25"></div>
此時(shí)生成了一個(gè)32位的唯一的JsessionID做為值.
與LoginAction中的get方法的saveToken(request)是一樣的.
此句的作用就是把一個(gè)jsessionid保存到request范圍里.
在我們后退重新調(diào)用:
if(this.isTokenValid(request,true))
{
System.out.println("valid");
return mapping.findForward("ok");
}
時(shí),就會(huì)拿login.jsp里傳過(guò)來(lái)的jsessionid和request的
進(jìn)行比較,如果一樣,說(shuō)明不合法.因?yàn)槲覀兊牟僮鞫际窃谝粋€(gè)請(qǐng)求會(huì)話里
操作的.說(shuō)明你在重復(fù)提交.
如果不一樣,說(shuō)明重新生成了一個(gè)唯一的jsessionid(新開一個(gè)瀏覽器),
開啟了一個(gè)新會(huì)話,重新提交,這是合法的.
這樣就防止了表單重復(fù)提交問(wèn)題.
源碼下載