防止双重表单提交
精确重复：如何处理多次提交服务器端
当前的一般任务：防止在多用户基于 Web 的应用程序中提交双重表单。 想想金融交易。
我有两种可以同时使用的方法：
- JavaScript 禁用按钮
- 缺点：如果禁用 JavaScript，则不起作用
- 后端验证 - 查看此类型的最后一个请求是在多久之前来自该用户的，如果不是太久，则发出错误
- 缺点：如果两个提交的内容足够接近，则每个提交可能无法了解对方
我正在寻找主题专家来贡献他们的最佳实践以及深奥的技巧。 可以是任何语言和框架，但 Django 是特别感兴趣的。 网络上已经写了很多关于手头任务的文章，但最好能在这里展示最佳实践。
Exact Duplicate: How to handle multiple submissions server-side
The general task at hand: preventing a double form submission in a multi-user web based application. Think financial transactions.
I have two methods which can be used in tandem:
- JavaScript disabling of button
- Disadvantage: does not work if JavaScript is disabled
- Back-end verfication - see how long ago the last request of this type came from this user and issue error if not too long ago
- Disadvantage: If the two submissions are close enough together, each may not be able to be aware of the other
I am looking for subject matter experts to contribute their best practices as well as esoteric tricks. Can be any language and framework, but Django is of specific interest. A lot has been written on the web about the task at hand, but it would be nice to have the best practices shown here.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
常见的解决方案是每次生成表单时在服务器上生成一个令牌。 将令牌存储在服务器上，将其作为隐藏字段添加到表单中，并在收到使用该令牌的表单提交后将其删除。
如果您收到没有有效令牌的表单提交，则意味着该表单已经提交并忽略它。
这具有向您的项目添加 XSRF 保护的额外优势。
The common solution is to generate a token on the server every time you generate a form. Store the token on the server, add it as a hidden field to the form, and delete it once you get a form submission with that token.
If you get a form submission without a valid token, it means that the form has already been submitted and ignore it.
This has the added advantage of adding XSRF protection to your project.