Google App Engine 上的 Stripes 问题
我在 Google App Engine 应用程序中使用 Stripes 表单时遇到问题。 我有一个带有 Stripes 表单标记的 JSP 页面。当我提交表单并且其中一个字段发生验证错误时，Stripes 会向我显示一个屏幕，其中包含以下通知：
事情是这样的。
需要有人（很可能是 Stripes 调度员）来获取 源页面分辨率。但没有提供源页面 请求，除非您覆盖 ActionBeanContext.getSourcePageResolution() 你将需要它 价值。当您使用标签时，名为“_sourcePage”的隐藏字段是 包括。如果您编写自己的表格或链接，可能会生成 验证错误，您必须包含此参数的值。这 可以通过调用 request.getServletPath() 来完成。”
我已经使用表单检查了页面的源，并且隐藏的输入字段 _sourcePage 按其应有的方式出现在表单中。该字段的值似乎以某种方式加密了。
I have problem with Stripes forms in the application for Google App Engine.
I have a JSP page with Stripes form tag. When I submit the form and a validation error occurs on one of the fields, Stripes shows me a screen with following notice:
Here's how it is.
Someone (quite possibly the Stripes Dispatcher) needed to get the
source page resolution. But no source page was supplied in the
request, and unless you override
ActionBeanContext.getSourcePageResolution() you're going to need that
value. When you use a tag a hidden field called '_sourcePage' is
included. If you write your own forms or links that could generate
validation errors, you must include a value for this parameter. This
can be done by calling request.getServletPath()."
I have checked source of the page with form and hidden input field _sourcePage is present in the form as it should be. Value of the field seems to be somehow encrypted.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
发送到客户端的值（隐藏表单字段等）的加密是 Stripes 功能之一，也是问题的原因之一。
为了加密和解密值，Stripes 使用一个密钥，该密钥在名为 Stripes.EncryptionKey 的配置属性中指定。
该属性没有默认值，因此如果未指定，Stripes 将在每次调用时生成随机密钥
应用程序已初始化。
这在传统的应用服务器上不一定是问题，而且安全性增强会受到欢迎，因为
密钥会不时更改。
另一方面，在 Google App Engine 上，这是一个主要问题。在 GAE 上不保证
一个用户会话范围内的后续请求将由具有相同生成密钥的同一应用程序提供服务。
App Engine 可以决定随时关闭任何正在运行的应用程序实例，如果下一个请求到来，它会
将启动另一个实例来服务请求（这称为“冷启动”）。这个新实例将具有新生成的密钥。
结果是应用程序将尝试使用与加密时不同的密钥来解密值，当然
未能这样做。
在这种情况下，Stripes 会记录一条警告“输入未使用当前加密密钥加密：”，并且表现为它尝试解密的参数根本不存在
（参见net.sourceforge.stripes.util.CryptoUtil）。在您的情况下，这意味着它的行为是 _sourcePage 参数不存在并且
这就是为什么如果发生验证错误，它会显示“情况如下”屏幕。
因此，如果您在 Google App Engine 上使用 Stripes，则应该为配置属性 Stripes.EncryptionKey 设置一些随机值。
Encryption of values that are sent to the client (hidden form fields etc.) is one of the Stripes features and it's a cause of the problem.
To encrypt and decrypt values Stripes use a key, that is specified in configuration property named Stripes.EncryptionKey.
This property doesn't have default value so if it's not specified, Stripes will generate random key each time the
application is initialized.
This needn't be a problem on traditional application server, moreover it can be welcomed security enhancement, because
key is changed from time to time.
On the other hand on Google App Engine this is a major problem. On GAE there is no guarantee that
subsequent requests in the scope of one user session will be served by the same application with same generated key.
App Engine can decide to shutdown any of the running instances of application anytime and if the next request comes, it
will start another instance to serve the request (this is called "cold start"). This new instance will have new generated key.
The result is that the application will try to decrypt the values with different key than they were encrypted with and of course
fails to do so.
In this situation Stripes logs a warning "Input was not encrypted with the current encryption key: " and behaves as parameter that it's trying to decrypt is not present at all
(see net.sourceforge.stripes.util.CryptoUtil). In your case it means that it behaves as _sourcePage parameter is not present and
that's why it shows "Here's how it is" screen if validation error occurs.
So if you use Stripes on Google App Engine, you should set some random value to configuration property Stripes.EncryptionKey.