Preventing Duplicate Form Submission in Struts using TOKEN

Duplicate form submission may occur in the following situations:-

• Using Refresh button
• Using the browser back button to traverse back and resubmit form
• Using Browser history feature and re-submit form.
• Malicious submissions to adversely impact the server or personal gains
• Clicking more than once on a transaction that take longer than usual

What happens in form submission? Suppose you have a form named adduser.jsp and an Action named saveUser.do. So, on clicking submit in the adduser.jsp page struts finds the mapping saveUser.do and redirect to this url. So, in the browser url you will find /app/saveUser.do.
and when you click on refresh same url is called and same form is submitted again. Struts provides several ways to protect this.

• HTTP redirect after form submission
• using TOKEN

HTTP redirect

Suppose form submission result is shown in a page called success.jsp. So, if redirect is set true in forward of action in struts.config URL in the URL bar becomes /app/success.jsp. So, if you refresh on again the success.jsp is called not the /app/saveUser.do. So, in this way we can protect against refresh. But, unfortunately this does not protect against goint to back button of browser and submit the form again.

Using TOKEN

This method generates a Token using session id, current time and messagediagest and save this token to session. The action responsible for rendering the form save the token using saveToken method. So, the session is saved in session and a hidden field name token with the value is set to html form. If you view the source of html form page you will find the hidden form as follows

<input type="hidden" name="org.apache.struts.taglib.html.TOKEN"value="some value">

When client submit the form this hidden field also submitted. Struts check the two TOKEN (token from session and token submitted). We can check the two token using isTokenValid method. If they are equal this method returns true and the form is submitted for the first time. If not equal then duplicate form submission. Checking code is shown below:-


if(isTokenValid(request))
resetToken(request);
else{
request.setAttribute("brtcerror","Duplicate Form Submission Error");
return mapping.findForward("error");
}

resetToken method is used to clear the Token set for this action. Because if you have multiple form you must clear the Token. Other wise for new form you will always find duplicate form submission error. Suppose action addUser renders adduser.jsp page. So, you have to save token in addUser corresponding class by calling saveToken(request) method. You should validate this token in the submit action which is saveUser.do here.