Maintain one session for the token

Provides various official and user-released code examples. For code reference, you are welcome to exchange and learn that the original token is a session corresponding to each page to store the _ hash _ value,
Each page header has a logon box. Each time a user accesses a page, a token is generated. If the user does not submit the token, the token will not be automatically destroyed (unless the session expires ).
A solution is to close the token through the configuration file and open the configuration parameters only in the required view.
However, I don't think my website needs to submit forms on multiple pages at the same time, and I use the session db hander extension. The char field length in the memory table is limited, it is impossible to store so many tokens infinitely.

Therefore, I decided to allow users to retain only one token.
There is another benefit in doing so, so that you can avoid submitting multiple pages at the same time and refresh the reply or something.
ThinkPHP/lib/Behavior/TokenBuildBehavior. class. php
Search // Create a form token
Private function buildToken (){
$ TokenName = C ('token _ name ');
$ TokenType = C ('token _ type ');
If (! Isset ($ _ SESSION [$ tokenName]) {
$ _ SESSION [$ tokenName] = array ();
}
// Identifies the uniqueness of the current page
$ TokenKey = md5 ($ _ SERVER ['request _ URI ']);
If (isset ($ _ SESSION [$ tokenName] [$ tokenKey]) {// No duplicate session is generated on the same page.
$ TokenValue = $ _ SESSION [$ tokenName] [$ tokenKey];
} Else {
$ TokenValue = $ tokenType (microtime (TRUE ));
$ _ SESSION [$ tokenName] [$ tokenKey] = $ tokenValue;
}
$ Token ='';
Return $ token;
}Changed: // Create a form token
Private function buildToken (){
$ TokenName = C ('token _ name ');
$ TokenType = C ('token _ type ');
// If (! Isset ($ _ SESSION [$ tokenName]) {
// $ _ SESSION [$ tokenName] = array ();
//}
$ _ SESSION [$ tokenName] = array (); // clear the existing token before generating the token.
// Identifies the uniqueness of the current page
$ TokenKey = md5 ($ _ SERVER ['request _ URI ']);
If (isset ($ _ SESSION [$ tokenName] [$ tokenKey]) {// No duplicate session is generated on the same page.
$ TokenValue = $ _ SESSION [$ tokenName] [$ tokenKey];
} Else {
$ TokenValue = $ tokenType (microtime (TRUE ));
$ _ SESSION [$ tokenName] [$ tokenKey] = $ tokenValue;
}
$ Token ='';
Return $ token;
}In this way, you can.

AD: truly free, domain name + VM + enterprise mailbox = 0 RMB