防止表单重复提交(只通过后台实现)

谁践踏了优雅 2022-02-27 03:20 470阅读 0赞

## 1.背景与介绍： ##

平时开发的项目中可能会出现下面这些情况：

1.  由于用户误操作，多次点击表单提交按钮。
2.  由于网速等原因造成页面卡顿，用户重复刷新提交页面。
3.  黑客或恶意用户使用postman等工具重复恶意提交表单（攻击网站）。

这些情况都会导致表单重复提交，造成数据重复，增加服务器负载，严重甚至会造成服务器宕机。因此有效防止表单重复提交有一定的必要性。

### 使用AOP自定义切入实现 ###

实现原理：

1.  自定义防止重复提交标记（@AvoidRepeatableCommit）。
2.  对需要防止重复提交的Congtroller里的mapping方法加上该注解。
3.  新增Aspect切入点，为@AvoidRepeatableCommit加入切入点。
4.  每次提交表单时，Aspect都会保存当前key到reids（须设置过期时间）。
5.  重复提交时Aspect会判断当前redis是否有该key，若有则拦截。

### **自定义标签：** ###

import java.lang.annotation.ElementType;
    import java.lang.annotation.Retention;
    import java.lang.annotation.RetentionPolicy;
    import java.lang.annotation.Target;
    
    /**
     * 避免重复提交
     * @ClassName: AvoidRepeatableCommit
     * @date: 2019/3/26 16:38
    */
    @Target(ElementType.METHOD)
    @Retention(RetentionPolicy.RUNTIME)
    public @interface AvoidRepeatableCommit {
    
        /**
         * 指定时间内不可重复提交,单位毫秒
         */
        long timeout()  default 3000 ;
    
    }

### 自定义切入点Aspect： ###

import com.ccx.ticket.Constants;
    import com.ccx.ticket.util.HttpUtil;
    import com.ccx.ticket.util.StringUtils;
    import lombok.extern.slf4j.Slf4j;
    import org.aspectj.lang.ProceedingJoinPoint;
    import org.aspectj.lang.annotation.Around;
    import org.aspectj.lang.annotation.Aspect;
    import org.aspectj.lang.reflect.MethodSignature;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.data.redis.core.RedisTemplate;
    import org.springframework.stereotype.Component;
    import org.springframework.web.context.request.RequestContextHolder;
    import org.springframework.web.context.request.ServletRequestAttributes;
    
    import javax.servlet.http.HttpServletRequest;
    import java.lang.reflect.Method;
    import java.util.UUID;
    import java.util.concurrent.TimeUnit;
    
    /**
     * 重复提交aop
     * @data: 2019-03-26 16:39
     **/
    @Aspect
    @Component
    @Slf4j
    public class AvoidRepeatableCommitAspect {
    
        @Autowired
        private RedisTemplate redisTemplate;
    
        /**
         * @param point
         */
        @Around("@annotation(com.ccx.ticket.filter.AvoidRepeatableCommit)")
        public Object around(ProceedingJoinPoint point) throws Throwable {
    
            HttpServletRequest request  = ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest();
            String ip = HttpUtil.getIpAddr(request);
            //获取注解
            MethodSignature signature = (MethodSignature) point.getSignature();
            Method method = signature.getMethod();
            //目标类、方法
            String className = method.getDeclaringClass().getName();
            String name = method.getName();
            String ipKey = String.format("%s#%s",className,name);
            int hashCode = Math.abs(ipKey.hashCode());
    
            String key = Constants.REDIS_ROOT+String.format("%s_%d",ip,hashCode);
    
            log.info("ipKey={},hashCode={},key={}",ipKey,hashCode,key);
            AvoidRepeatableCommit avoidRepeatableCommit =  method.getAnnotation(AvoidRepeatableCommit.class);
            long timeout = avoidRepeatableCommit.timeout();
            if (timeout < 0){
                timeout = 3*Constants.SECOND;
            }
            String value = (String) redisTemplate.opsForValue().get(key);
            if (StringUtils.isNotBlank(value)){
    
                return "请勿重复提交";
            }
            redisTemplate.opsForValue().set(key, UUID.randomUUID().toString(),timeout, TimeUnit.MILLISECONDS);
            //执行方法
            Object object = point.proceed();
    
            return object;
        }
    
    }

### 常量类： ###

public class Constants {
    
    	public static final String REDIS_ROOT="WX:ccx-:";
    
    	public static final long DAY = 1000L*60*60*24;
    
    	public static final long HOUR = 1000L*60*60;
    
    	public static final long MINUTE = 1000L*60;
    
    	public static final long MINUTE_10 = 1000L*60*10;
    
    	public static final long HALF_HOUR = 1000L*60*30;
    
    	public static final long SECOND = 1000L;
    }

### 使用方法： ###

在需要避免重复提交的api接口上，添加此注释既可

@AvoidRepeatableCommit
        @RequestMapping(value = "/search", produces = MediaType.APPLICATION_JSON_UTF8_VALUE, method = RequestMethod.POST)
        @ResponseBody
        public ResponseMsg<Map> preSearch(@RequestBody(required = false) Map<String, Object> param) {
    
           //具体处理业务
    
        return null;
    }

### 说明 （遇到的一个问题）： ###

如果在预期短时间内重复请求，取出缓存的value值不为空，此时返回为一个String的字符串，调用真正执行的方法时候类型不一样，必然会报类型转换异常，因为这里已经做了全局异常处理，并且是前后端分离，所以这里就这个异常不在进行处理

请勿重复提交
    2019-03-26 17:32:18,524:ERROR http-nio-9001-exec-7 (GlobalExceptionHandler.java:50) - 
    2019-03-26 17:32:18,525:ERROR http-nio-9001-exec-7 (GlobalExceptionHandler.java:71) - {}
    java.lang.ClassCastException: java.lang.String cannot be cast to com.ccx.msmc.common.plugins.ResponseMsg
    	at com.ccx.ticket.controller.EnterpriseController$$EnhancerBySpringCGLIB$$6a0ef95.enterpriseList(<generated>) ~[classes/:?]
    	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_161]
    	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_161]
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_161]
    	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_161]
    	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:215) ~[spring-web-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:142) ~[spring-web-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102) ~[spring-webmvc-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895) ~[spring-webmvc-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:800) ~[spring-webmvc-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1038) [spring-webmvc-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942) [spring-webmvc-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:998) [spring-webmvc-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:890) [spring-webmvc-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:634) [tomcat-embed-core-9.0.12.jar:9.0.12]
    	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:875) [spring-webmvc-5.1.2.RELEASE.jar:5.1.2.RELEASE]
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) [tomcat-embed-core-9.0.12.jar:9.0.12]
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) [tomcat-embed-core-9.0.12.jar:9.0.12]
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.12.jar:9.0.12]
    	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) [tomcat-embed-websocket-9.0.12.jar:9.0.12]
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-9.0.12.jar:9.0.12]
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-9.0.12.jar:9.0.12]
    	at com.ccx.ticket.filter.PassHttpFilter.doFilter(PassHttpFilter.java:34) [classes/:?]

参考：

[https://www.cnblogs.com/huanghuizhou/p/9153837.html][https_www.cnblogs.com_huanghuizhou_p_9153837.html]

[https_www.cnblogs.com_huanghuizhou_p_9153837.html]: https://www.cnblogs.com/huanghuizhou/p/9153837.html