aspose file tools*
The moose likes Struts and the fly likes Multiple-submit prevention in JSF Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of Soft Skills this week in the Jobs Discussion forum!
JavaRanch » Java Forums » Frameworks » Struts
Bookmark "Multiple-submit prevention in JSF" Watch "Multiple-submit prevention in JSF" New topic
Author

Multiple-submit prevention in JSF

Nicholas Cheung
Ranch Hand

Joined: Nov 07, 2003
Posts: 4982
Cay and David,

In Struts, in order to prevent multiple submission, we need to use a token to identify the submit action. How about JSF? Does the same methodology applied?

Nick


SCJP 1.2, OCP 9i DBA, SCWCD 1.3, SCJP 1.4 (SAI), SCJD 1.4, SCWCD 1.4 (Beta), ICED (IBM 287, IBM 484, IBM 486), SCMAD 1.0 (Beta), SCBCD 1.3, ICSD (IBM 288), ICDBA (IBM 700, IBM 701), SCDJWS, ICSD (IBM 348), OCP 10g DBA (Beta), SCJP 5.0 (Beta), SCJA 1.0 (Beta), MCP(70-270), SCBCD 5.0 (Beta), SCJP 6.0, SCEA for JEE5 (in progress)
Gregg Bolinger
GenRocket Founder
Ranch Hand

Joined: Jul 11, 2001
Posts: 15300
    
    6

The multi-submit problem is being resolved in JSF 1.2. You can read about the Specification proposal here.


GenRocket - Experts at Building Test Data
Nicholas Cheung
Ranch Hand

Joined: Nov 07, 2003
Posts: 4982

The multi-submit problem is being resolved in JSF 1.2

But currently, we only have JSF 1.0. At the meantime, what should we do to prevent this?

Nick
Nicholas Cheung
Ranch Hand

Joined: Nov 07, 2003
Posts: 4982
In addition, when will JSF 1.2 implementation release?

Nick
Gregg Bolinger
GenRocket Founder
Ranch Hand

Joined: Jul 11, 2001
Posts: 15300
    
    6

Originally posted by Nicholas Cheung:

But currently, we only have JSF 1.0. At the meantime, what should we do to prevent this?

Nick


I find that smacking click happy users in the back of the head works wonders.
Varun Khanna
Ranch Hand

Joined: May 30, 2002
Posts: 1400
Originally posted by Nicholas Cheung:

But currently, we only have JSF 1.0. At the meantime, what should we do to prevent this?

Nick


One of the "not so fancy" approach I have seen is once user clicks the submit button, display a dthml saying "Please wait ....." covering your submit button but tht's pretty non-jsf and wont work in case the user refreshes the page.


- Varun
Gregg Bolinger
GenRocket Founder
Ranch Hand

Joined: Jul 11, 2001
Posts: 15300
    
    6

Originally posted by K Varun:


One of the "not so fancy" approach I have seen is once user clicks the submit button, display a dthml saying "Please wait ....." covering your submit button but tht's pretty non-jsf and wont work in case the user refreshes the page.


You could also disable the submit button the first time it is clicked.
David Geary
Author
Ranch Hand

Joined: Apr 23, 2003
Posts: 45
I've handled this in JSF with a custom tag that puts unique tokens in both request and session scopes. Then I have a custom action listener that checks to make sure the tokens are present and equal for sensitive form submits.

If you send me email at sabreware@earthlink.net, I can send you a JAR file with the tag and listener.


David Geary Sabreware, Inc<br /><a href="http://www.corejsf.com" target="_blank" rel="nofollow">http://www.corejsf.com</a><br /> <br />Author: Graphic Java Series, Advanced JavaServerPages, Core JSTL and Core JavaServer Faces
Nicholas Cheung
Ranch Hand

Joined: Nov 07, 2003
Posts: 4982
Thanks David.

Just one question, what is the best way for me to obtain a unique *non-random* ticket? I understand that even I generate this ticket using random number, it is of a high chance that the 2 numbers won't be the same within the session, but I have no proof of concept that it really works.

I will send you an email soon.

Thanks.

Nick
 
Consider Paul's rocket mass heater.
 
subject: Multiple-submit prevention in JSF