| Author |
Multiple-submit prevention in JSF
|
Nicholas Cheung
Ranch Hand
Joined: Nov 07, 2003
Posts: 4982
|
|
Cay and David,
In Struts, in order to prevent multiple submission, we need to use a token to identify the submit action. How about JSF? Does the same methodology applied?
Nick
|
SCJP 1.2, OCP 9i DBA, SCWCD 1.3, SCJP 1.4 (SAI), SCJD 1.4, SCWCD 1.4 (Beta), ICED (IBM 287, IBM 484, IBM 486), SCMAD 1.0 (Beta), SCBCD 1.3, ICSD (IBM 288), ICDBA (IBM 700, IBM 701), SCDJWS, ICSD (IBM 348), OCP 10g DBA (Beta), SCJP 5.0 (Beta), SCJA 1.0 (Beta), MCP(70-270), SCBCD 5.0 (Beta), SCJP 6.0, SCEA for JEE5 (in progress)
|
 |
Gregg Bolinger
Ranch Hand
Joined: Jul 11, 2001
Posts: 15230
|
|
|
The multi-submit problem is being resolved in JSF 1.2. You can read about the Specification proposal here.
|
|
Nicholas Cheung
Ranch Hand
Joined: Nov 07, 2003
Posts: 4982
|
|
The multi-submit problem is being resolved in JSF 1.2
But currently, we only have JSF 1.0. At the meantime, what should we do to prevent this?
Nick
|
|
Nicholas Cheung
Ranch Hand
Joined: Nov 07, 2003
Posts: 4982
|
|
In addition, when will JSF 1.2 implementation release?
Nick
|
|
Gregg Bolinger
Ranch Hand
Joined: Jul 11, 2001
Posts: 15230
|
|
Originally posted by Nicholas Cheung:
But currently, we only have JSF 1.0. At the meantime, what should we do to prevent this?
Nick
I find that smacking click happy users in the back of the head works wonders. 
|
|
Varun Khanna
Ranch Hand
Joined: May 30, 2002
Posts: 1400
|
|
Originally posted by Nicholas Cheung:
But currently, we only have JSF 1.0. At the meantime, what should we do to prevent this?
Nick
One of the "not so fancy" approach I have seen is once user clicks the submit button, display a dthml saying "Please wait ....." covering your submit button  but tht's pretty non-jsf and wont work in case the user refreshes the page.
|
- Varun
|
|
Gregg Bolinger
Ranch Hand
Joined: Jul 11, 2001
Posts: 15230
|
|
Originally posted by K Varun: One of the "not so fancy" approach I have seen is once user clicks the submit button, display a dthml saying "Please wait ....." covering your submit button but tht's pretty non-jsf and wont work in case the user refreshes the page.
You could also disable the submit button the first time it is clicked.
|
|
David Geary
Author
Ranch Hand
Joined: Apr 23, 2003
Posts: 45
|
|
I've handled this in JSF with a custom tag that puts unique tokens in both request and session scopes. Then I have a custom action listener that checks to make sure the tokens are present and equal for sensitive form submits.
If you send me email at sabreware@earthlink.net, I can send you a JAR file with the tag and listener.
|
David Geary Sabreware, Inc<br /><a href="http://www.corejsf.com" target="_blank" rel="nofollow">http://www.corejsf.com</a><br /> <br />Author: Graphic Java Series, Advanced JavaServerPages, Core JSTL and Core JavaServer Faces
|
|
Nicholas Cheung
Ranch Hand
Joined: Nov 07, 2003
Posts: 4982
|
|
Thanks David.
Just one question, what is the best way for me to obtain a unique *non-random* ticket? I understand that even I generate this ticket using random number, it is of a high chance that the 2 numbers won't be the same within the session, but I have no proof of concept that it really works.
I will send you an email soon.
Thanks.
Nick
|
|
 |
|
|
subject: Multiple-submit prevention in JSF
|
|
|
0
