Duplicate Form Submission

[achalise]

Hi ,

I have been trying to disable duplicate form submission in the application that I am working on. I followed the JavaDoc on AbstractFormController.handleInvalidSubmit() and had the method handleInvalidSubmit() overridden in the subclass to return to an error page.
Also the form used for this controller is a session form. However after submitting the form, I can still resubmit it by going back and clicking submit.

I thought all I needed to do was override the handleInvalidSubmit() method in the subclass and have the form as sessionForm. Pls also note that I have not overridden formBackingObject(), hence it never returns a preinitialized backing object (but should this matter ?).

When I tried to debug, I notice that handleInvalidSubmit() never gets called. So I guess in AbstractFormController.handleRequestInternal(),
if (isSessionForm() && request.getSession().getAttribute(getFormSessionAt tributeName()) == null) {
// cannot submit a session form if no form object is in the session
return handleInvalidSubmit(request, response);
}
the condition is never true.

Could someone please help me out ?

Thanks a lot in advance.

Arun chalise

[ojolly]

The 'session form' way sets the command in the session when the form is shown (which includes form reshowing when validation failed) and remove it when the command is read.
Could you set a breakpoint on the getCommand(HttpServletRequest) method to see what happens? It is normally called in the handleRequestInternal method just after the check for invalid submission you quoted.

Olivier

[achalise]

I realized that i had put

response.setHeader("Cache-Control","no-store"); //HTTP 1.1
response.setHeader("Pragma","no-cache"); //HTTP 1.0

in the page that i was trying to test duplicate form submission.
And realized that everytime I hit back to return to the page, the getFormSessionAttributeName()) == null condition failed as it was not using 'cache' and was always issuing request to the server in whichcase showForm would be called and the session attribute name for the form would be set.

Once I set the response headers to not use cache, it all works fine.

Thanks
arun

[mfc42d]

prevent duplicate submit

 protected ModelAndView disallowDuplicateFormSubmission(HttpServletRequest
        request, HttpServletResponse response) throws Exception
    {
        BindException errors = new BindException(formBackingObject(request),
                                                 getCommandName());
        errors.reject("duplicateFormSubmission", "Duplicate form submission");
        return showForm(request, response, errors);
    }