Token validation in Java

What is token: It is a token that is randomly unpredictable.

Why you need to use Token:1 to prevent duplicate submissions of forms

2: To prevent cross-site request forgery

Token's use flow is: first generate a random token value on the server side and save it on the server side, then pass the token value to the client during the request process. After the page operation is completed to the server to submit data to the server side, while comparing the token value is already present in the server side, if there is, the visit is secure, and the server side to the token value is deleted, if not, then this visit is invalid.

OK, look at the code after token usage (you can paste it directly in the project)

---------------------------------------------------------------------The following is the reproduced code:

(i) First, the Token tool class

[Java]View plain copy

2. Package com.company.util;
4. Import java.util.ArrayList;
6. Import javax.servlet.http.HttpSession;
8. Public class Token {
10. Private static final String token_list_name = "Tokenlist";
12. Public static final String token_string_name = "TOKEN";
16. Private static ArrayList Gettokenlist (HttpSession session) {
18. Object obj = Session.getattribute (token_list_name);
20. if (obj! = null) {
22. return (ArrayList) obj;
24. } Else {
26. ArrayList tokenlist = new ArrayList ();
28. Session.setattribute (Token_list_name, tokenlist);
30. return tokenlist;
32. }
34. }
38. Private static void savetokenstring (String tokenstr, HttpSession session) {
40. ArrayList tokenlist = gettokenlist (session);
42. Tokenlist.add (TOKENSTR);
44. Session.setattribute (Token_list_name, tokenlist);
46. }
50. Private static String generatetokenstring () {
52. return New Long (System.currenttimemillis ()). ToString ();
54. }
58. /** *//** 
60. * Generate a token string, and save the string in session, then return the token string.
62. * @param HttpSession Session
64. * @return A token string used for enforcing a single request for a particular transaction.
66. */
70. public static String Gettokenstring (HttpSession session) {
72. String tokenstr = generatetokenstring ();
74. Savetokenstring (TOKENSTR, session);
76. return tokenstr;
78. }
82. /** *//** 
86. * Check whether token string is valid. If session contains the token string, return True.
88. * Otherwise, return false.
90. * @param String Tokenstr
92. * @param HttpSession Session
94. * @return True:session contains tokenstr; False:session is null or TOKENSTR are ID not in session
96. */
100. public Static boolean istokenstringvalid (String Tokenstr, HttpSession session) {
102. Boolean valid = false;
104. if (session! = null) {
106. ArrayList tokenlist = gettokenlist (session);
108. if (Tokenlist.contains (TOKENSTR)) {
110. valid = true;
112. Tokenlist.remove (TOKENSTR);
114. }
116. }
118. return valid;
120. }
122. }

(ii) in the JSP page

1: Import the Token tool class first

[Java]View plain copy

1. <%@ page import="Com.company.util.Token"%>

2: Add hidden token values to the form

[HTML]View plain copy

1. <form>
2. <input type="hidden" name= "<%=token.token_string_name%>" value= "<%= Token.gettokenstring (session)%> ">
3. </form>

(iii) Add the following code to the server-side servlet

[Java]View plain copy

1. if (Token.istokenstringvalid (Request.getparameter (Token.token_string_name), Request.getsession ())) {
2. //to do business code
3. }

Token validation in Java