Re: jsp form double posting

From: Erwin Moller (since_humans_read_this_I_am_spammed_too_much_at_spamyourself.com)
Date: 11/17/03 

Date: Mon, 17 Nov 2003 12:40:10 +0100

<snip>

>
> Thanks folks. I will try the first solution about disabling the
> button first before posting the form. If that still fails, will try
> the token solution. In any case, would the javascript solution break
> if javascript is disabled? Is there a way to check for this? What to
> do in that case?
>
> Thx again,
> Guru

Hi,

If javascript is disabled the javascriptsolution will not work, even worse,
if implemented as I suggested, your whole form will not be submitted
because javascript give the form.submit() command.

No workaround there I am afraid.

If you think the token-approach is too complicated, you can do it a little
more 'dirty', but easier like this:

use the session of the user to make sure he/she won't post the same form
within, say, 2 seconds, or whatever you think is a double impatient click.

You can store in the session a timestamp, and before inserting thing into a
database, you check if more than 2 seconds have passed by comparing the
timestamp in the session with the current time.

if the time passed is less than what you consider reasonable, you refuse the
second posting.

This is very easy to implement.

Good luck,

Let us know how you solved it.

Regards,
Erwin Moller

Relevant Pages

  • Re: How does GMail know I use Firebug extension in Iceweasel?
    ... "Firebug is known to make Gmail slow unless it is configured correctly." ... find disturbing is how gmail 'knows' what extensions I have installed on ... I do use the javascript version gmail instead of the plain html one. ... Disabling javascript renders most sites pretty useless. ...
    (Debian-User)
  • Re: Protect links
    ... whilst the numbers might be quite large in absolute terms, ... record statistics). ... Whilst I understand the motive for disabling ... Javascript, you can't get far without encountering problems these days, ...
    (comp.infosystems.www.authoring.html)
  • RE: Client Side validation and Post to method in CodeBehind Class
    ... Thanks for posting in the community! ... Then we can use the below javascript to post back the form. ... you can do some operations in the page's Page_Load handler in ...
    (microsoft.public.dotnet.framework.aspnet)
  • Rationalle for Disabling JavaScript
    ... What is the rationalle for disabling JavaScript. ... is for "security purposes" - but what specific kind of threats does the ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How do I stop my internal IP address being viewable externally?
    ... > Java applet on the browser that's pulling the internal IP so that you can ... Thanks Duane. ... It appeared to be a javascript issue. ... Disabling javascript "fixed" it... ...
    (comp.security.firewalls)