However, there is a situation that cannot be prevented:
After the user submits the form, click the browser Back button to return to the form page, this time the browser will be directly from the cache to remove the page, so token verification must be a pass.
There are many ways to circumvent this problem, such as using the Location.replace () method to replace the current history, but there are still flaws. In extreme cases, if users switch multiple times between pages, a few more times the back button is likely to return to the previous form page.
The workaround is to set the Cache-control:no-cache in the HTTP header, No-store. However I tried to add it either in the page head
Looked for a long time, found the problem in the thinkphp template rendering mechanism, open thinkphp/lib/think/core/view.class.php see line 173th
header( "Cache-control: private" ); //支持页面回跳 |
The original TP in order to support the page bounce, forcing the output of each template before sending a cache-control:private head, which is really helpful.
Comment out this line, delete the TP core cache, and try again to find that the HTTP response header has changed successfully
The above describes the ThinkPad s230u twist thinkphp to prevent the form of repeated submissions, including ThinkPad s230u twist content, I hope to be interested in PHP tutorial friends helpful.