There is one situation, however, that cannot be prevented:
After the user submits the form, click the browser Back button to return to the form page, this time the browser will be directly from the cache to remove the page, so token verification must be pass.
There are a number of ways to circumvent this problem, such as replacing the current history with the Location.replace () method, but this is still flawed. In extreme cases, if the user switches between pages several times, then a few more times the back button is likely to return to the previous form page.
The workaround is to set the Cache-control:no-cache in the HTTP header, No-store. However, I tried to add <meta http-equiv= "Cache-control" content= "No-cache, No-store" > or output Header ("in action") either in the page head. Cache-control:no-cache, No-store ") are invalid.
Looking for a long time, found the problem in the thinkphp template rendering mechanism, open thinkphp/lib/think/core/view.class.php to see line 173th
header("Cache-control: private"); //支持页面回跳 |
The original TP in order to support page bounce, forcing the output of each template before sending a cache-control:private head, it is really helpful to the busy.
Comment out this line, delete the TP core cache, and try again to discover that the HTTP response header has successfully changed