Yah, I'm not so sure I like this article. It's a bit weak on a number of points.
If someone disagrees with my points, please say so! This is something I'm not an expert at! And besides, I'm typing this code into the box without compiling!
The author is saying that you can use the existence or non-existence of a session as a 'token'. The idea of a token is a fairly common method of handling the multiple-submit problem. I think if you searched this forum, you'd find a number of hits. I myself have never implemented the token approach, but this is NOT how I'd do it.
For one... most sites that I have ever coded use sessions. Most of the time, a user would already HAVE a session by the time they have filled out their personal information, selected the concert, entered their CC number and finally clicked 'submit'. I mean really.. the session is gonna BE There! So to use, as your token, the existence of the session is a bit odd. The token is *stored* in your session.
How I always imagined it happening was somewhat like this:Perhaps on the view page you might do a final bit of clean-up (like remove the session attribute 'submit', so the same user could then make a second purchase within the same session)
Other things I have a problem with:
His code has: String encodedURL = res.encodeURL("/RedirectServlet"); But uh... he uses sendRedirect().
So maybe that should have been: String encodedURL = res.encodeRedirectURL("/RedirectServlet");
In his sidebar note 'forward vs. sendRedirect': However, forward comes at a price; the new session ID is not attached to the URL. Huh? It's not 'encoded' into the URL, but it's *available* in the resource to which you're forwarding, so what's the big deal?