You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Karthik Nanjangude <ka...@xius-bcgi.com> on 2010/05/13 09:45:37 UTC
multiple form submits
Hi
Spec :
JDK1.5
TOMCAT 6.0.20
O/s windows /Linux
Question : My web application uses "href" & "css based image's" for transferring the request from 1 page to another
The problem is UserVisitor is clicking the image based href MULTIPLE TIMES ( multiple clicks )
<a href="image.jsp?mult=1" id='submitButton1' onClick="this.onclick=function(){return false}" target="_self"
class="buttonRedSmall"><span>Submit Form</span></a></td>
And causes the multiple form submits. How to prevent the same ?
I googled / yahooed for Cross browser based tricks to disable the multiple request...Not luck so far ...
Can some body help me if Tomcat has any special features to prevent this attack ....... :(
with regards
N.S.Karthik
Re: multiple form submits
Posted by Steve Yates <sy...@stevendyates.com>.
Karthik,
I have just re-iterated what Pid has already explained. I am not fast
enough.
+1 Pid
RGS
On 5/13/2010 6:10 PM, Pid wrote:
> On 13/05/2010 08:45, Karthik Nanjangude wrote:
>
>> Hi
>>
>> Spec :
>> JDK1.5
>> TOMCAT 6.0.20
>> O/s windows /Linux
>>
>>
>> Question : My web application uses "href" & "css based image's" for transferring the request from 1 page to another
>> The problem is UserVisitor is clicking the image based href MULTIPLE TIMES ( multiple clicks )
>>
> Why is this a problem?
>
>
>> <a href="image.jsp?mult=1" id='submitButton1' onClick="this.onclick=function(){return false}" target="_self"
>> class="buttonRedSmall"><span>Submit Form</span></a></td>
>>
> 1. Unset the href value, or set it to '#image.jsp?mult=1". You can
> always set a timer, to remove the '#' after a couple of seconds, if the
> page hasn't changed.
>
> 2. Use a <button></button> instead and disable it during the first mouse
> down.
>
>
>> And causes the multiple form submits. How to prevent the same ?
>>
>> I googled / yahooed for Cross browser based tricks to disable the multiple request...Not luck so far ...
>>
>> Can some body help me if Tomcat has any special features to prevent this attack ....... :(
>>
> It doesn't.
>
>
> p
>
>
Re: multiple form submits
Posted by Pid <pi...@pidster.com>.
On 13/05/2010 08:45, Karthik Nanjangude wrote:
> Hi
>
> Spec :
> JDK1.5
> TOMCAT 6.0.20
> O/s windows /Linux
>
>
> Question : My web application uses "href" & "css based image's" for transferring the request from 1 page to another
> The problem is UserVisitor is clicking the image based href MULTIPLE TIMES ( multiple clicks )
Why is this a problem?
> <a href="image.jsp?mult=1" id='submitButton1' onClick="this.onclick=function(){return false}" target="_self"
> class="buttonRedSmall"><span>Submit Form</span></a></td>
1. Unset the href value, or set it to '#image.jsp?mult=1". You can
always set a timer, to remove the '#' after a couple of seconds, if the
page hasn't changed.
2. Use a <button></button> instead and disable it during the first mouse
down.
> And causes the multiple form submits. How to prevent the same ?
>
> I googled / yahooed for Cross browser based tricks to disable the multiple request...Not luck so far ...
>
> Can some body help me if Tomcat has any special features to prevent this attack ....... :(
It doesn't.
p
Re: multiple form submits
Posted by Steve Yates <sy...@stevendyates.com>.
Hello Karthik,
It is a little difficult for application server such as Tomcat to
implement such validation as every request received through your
configured connector is essentially a genuine request from Tomcats point
of view. Unless you created a complex Valve of some sort which measured
the time difference between two requests from the same host to the same
URI and requested that Tomcat consider one to be a duplicate of the
other and therefore drop it, this is sort of the wrong way to approach it.
One little trick I have employed in the past is to temporarily disable
the button/link by using a little bit of Javascript not too dissimilar
to what you have done already. Without giving too much away have you
considered dynamically changing the href value of the anchor to either
nothing or an internal anchor '#' with the onClick method.
RGS
SY
On 5/13/2010 5:45 PM, Karthik Nanjangude wrote:
> Hi
>
> Spec :
> JDK1.5
> TOMCAT 6.0.20
> O/s windows /Linux
>
>
> Question : My web application uses "href" & "css based image's" for transferring the request from 1 page to another
> The problem is UserVisitor is clicking the image based href MULTIPLE TIMES ( multiple clicks )
>
> <a href="image.jsp?mult=1" id='submitButton1' onClick="this.onclick=function(){return false}" target="_self"
> class="buttonRedSmall"><span>Submit Form</span></a></td>
>
> And causes the multiple form submits. How to prevent the same ?
>
> I googled / yahooed for Cross browser based tricks to disable the multiple request...Not luck so far ...
>
> Can some body help me if Tomcat has any special features to prevent this attack ....... :(
>
>
>
>
> with regards
>
> N.S.Karthik
>
>
>
Re: multiple form submits
Posted by André Warnier <aw...@ice-sa.com>.
Just some comments..
> How about the following?
>
> When the form is submitted, display a page without a submit button that
> 1) indicates the form is being processed and 2) submits the form data
> for actual processing.
>
And in the meantime, where is the page with the form with the data that
has to be submitted ?
...
>>
>> I've toyed with things like this (mostly by disabling form submit
>> buttons) but I've always been worried that something will interrupt the
>> submission process itself, leaving a user with a form that will never
>> submit again. :(
>>
>> I'd love to hear some clever solutions to this problem. I started
>> writing a javascript function that would disable the submit button, then
>> schedule it to be re-enabled in, say, 30 seconds, but it was a bit
>> fragile.
>>
Ok, how about having the submit button inside of a <div>, of which you
toggle the display:visible style attribute ?
Once it is clicked, it disappears.
After all, once you have clicked it once, you really /don't/ need it
ever again, not for the same form you don't.
You may need the same form again, with other values, but that would be
after the server has accepted the first post, and sent maybe a new clean
form.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Re: multiple form submits
Posted by "Terence M. Bandoian" <te...@tmbsw.com>.
How about the following?
When the form is submitted, display a page without a submit button that
1) indicates the form is being processed and 2) submits the form data
for actual processing.
-Terence Bandoian
Christopher Schultz wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Pid,
>
> On 5/17/2010 4:43 PM, Pid wrote:
>
>> On 17/05/2010 21:07, Christopher Schultz wrote:
>>
>>> Karthik,
>>>
>>> On 5/13/2010 3:45 AM, Karthik Nanjangude wrote:
>>>
>>>> Question : My web application uses "href" & "css based image's"
>>>> for transferring the request from 1 page to another The problem is
>>>> UserVisitor is clicking the image based href MULTIPLE TIMES (
>>>> multiple clicks )
>>>>
>>> Ok.
>>>
>>>
>>>> <a href="image.jsp?mult=1" id='submitButton1'
>>>> onClick="this.onclick=function(){return false}" target="_self"
>>>> class="buttonRedSmall"><span>Submit Form</span></a></td>
>>>>
>>> That's a nasty construct: when the user clicks the link, you change the
>>> onClick handler? How about this:
>>>
>>> <a href="image.jsp?mult=1" id='submitButton1'
>>> onclick="return false;"
>>> class="buttonRedSmall"><span>Submit Form</span></a>
>>>
>> The goal of the original code is to change the onclick handler such that
>> on the *second* click, the handler returns false and so stops the
>> action, theoretically preventing the multiple click stream problem.
>>
>
> That's fine, but the onclick handler doesn't do anything but disable
> itself upon the first click. Perhaps this is a toy example and not the
> real thing. Again, this link does not submit a form in the first place
> unless a lot of information has been removed.
>
> I've toyed with things like this (mostly by disabling form submit
> buttons) but I've always been worried that something will interrupt the
> submission process itself, leaving a user with a form that will never
> submit again. :(
>
> I'd love to hear some clever solutions to this problem. I started
> writing a javascript function that would disable the submit button, then
> schedule it to be re-enabled in, say, 30 seconds, but it was a bit fragile.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkv1QMgACgkQ9CaO5/Lv0PA15wCgrqJhjo2w+xlcuYZwxnLX7/1l
> GLQAoKd31cKOBb99T2TxlZK2PRyil07a
> =xhnm
> -----END PGP SIGNATURE-----
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: multiple form submits
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hassan,
On 5/20/2010 10:31 AM, Hassan Schroeder wrote:
> On Thu, May 20, 2010 at 7:01 AM, Christopher Schultz
> <ch...@christopherschultz.net> wrote:
>
>>>>> UserVisitor is clicking the image based href MULTIPLE TIMES
>
>> I'd love to hear some clever solutions to this problem.
>
> Create a unique value in a hidden field in each displayed form.
>
> Have a servlet filter save the value of that field; if a subsequent request
> contains that same value, just drop the request.
We do use Struts' version of this technique (they call them "tokens")
but the problem is that the second request is the response the user
sees: to the user, the second request has "failed" while the first
request may still be processing, or have correctly completed and the
response was never received.
It's better to avoid the second request in the first place, and the only
way to do that is to convince the client not to send it.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkv1phkACgkQ9CaO5/Lv0PCquwCgn4ixN7TVpkkQ1PWxjxdzGxGU
7+AAoJP8/bLhNKnzm7bFLKE6iUYHyEN9
=kMue
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: multiple form submits
Posted by Hassan Schroeder <ha...@gmail.com>.
On Thu, May 20, 2010 at 7:01 AM, Christopher Schultz
<ch...@christopherschultz.net> wrote:
>>>> UserVisitor is clicking the image based href MULTIPLE TIMES
> I'd love to hear some clever solutions to this problem.
Create a unique value in a hidden field in each displayed form.
Have a servlet filter save the value of that field; if a subsequent request
contains that same value, just drop the request.
--
Hassan Schroeder ------------------------ hassan.schroeder@gmail.com
twitter: @hassan
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: multiple form submits
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Pid,
On 5/20/2010 11:51 AM, Pid wrote:
> On 20/05/2010 15:01, Christopher Schultz wrote:
>> That's fine, but the onclick handler doesn't do anything but disable
>> itself upon the first click.
>
> It doesn't need to; after the scriptlet completes it'll continue as
> normal and (start to) load the contents of the href attribute because
> the scriptlet didn't return a false value to stop further action, on
> this occasion.
Oh, duh. That's actually quite a clever strategy!
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkv1pmoACgkQ9CaO5/Lv0PBe0ACfeTdqPOYKgSLp3g0rZ0a4X75e
H9YAoLq0Ips8f1ZnSbxZMus0JyO/8Hq5
=NnXh
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: multiple form submits
Posted by Pid <pi...@pidster.com>.
On 20/05/2010 15:01, Christopher Schultz wrote:
> Pid,
>
> On 5/17/2010 4:43 PM, Pid wrote:
>> On 17/05/2010 21:07, Christopher Schultz wrote:
>>> Karthik,
>>>
>>> On 5/13/2010 3:45 AM, Karthik Nanjangude wrote:
>>>> Question : My web application uses "href" & "css based image's"
>>>> for transferring the request from 1 page to another The problem is
>>>> UserVisitor is clicking the image based href MULTIPLE TIMES (
>>>> multiple clicks )
>>>
>>> Ok.
>>>
>>>> <a href="image.jsp?mult=1" id='submitButton1'
>>>> onClick="this.onclick=function(){return false}" target="_self"
>>>> class="buttonRedSmall"><span>Submit Form</span></a></td>
>>>
>>> That's a nasty construct: when the user clicks the link, you change the
>>> onClick handler? How about this:
>>>
>>> <a href="image.jsp?mult=1" id='submitButton1'
>>> onclick="return false;"
>>> class="buttonRedSmall"><span>Submit Form</span></a>
>
>> The goal of the original code is to change the onclick handler such that
>> on the *second* click, the handler returns false and so stops the
>> action, theoretically preventing the multiple click stream problem.
>
> That's fine, but the onclick handler doesn't do anything but disable
> itself upon the first click.
It doesn't need to; after the scriptlet completes it'll continue as
normal and (start to) load the contents of the href attribute because
the scriptlet didn't return a false value to stop further action, on
this occasion.
> Perhaps this is a toy example and not the
> real thing. Again, this link does not submit a form in the first place
> unless a lot of information has been removed.
I'd put it down to a slightly muddled OP.
> I've toyed with things like this (mostly by disabling form submit
> buttons) but I've always been worried that something will interrupt the
> submission process itself, leaving a user with a form that will never
> submit again. :(
>
> I'd love to hear some clever solutions to this problem. I started
> writing a javascript function that would disable the submit button, then
> schedule it to be re-enabled in, say, 30 seconds, but it was a bit fragile.
I also found it fragile & prone to sticking in the "disabled" state.
Hassan mentions the better alternative.
p
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: multiple form submits
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Pid,
On 5/17/2010 4:43 PM, Pid wrote:
> On 17/05/2010 21:07, Christopher Schultz wrote:
>> Karthik,
>>
>> On 5/13/2010 3:45 AM, Karthik Nanjangude wrote:
>>> Question : My web application uses "href" & "css based image's"
>>> for transferring the request from 1 page to another The problem is
>>> UserVisitor is clicking the image based href MULTIPLE TIMES (
>>> multiple clicks )
>>
>> Ok.
>>
>>> <a href="image.jsp?mult=1" id='submitButton1'
>>> onClick="this.onclick=function(){return false}" target="_self"
>>> class="buttonRedSmall"><span>Submit Form</span></a></td>
>>
>> That's a nasty construct: when the user clicks the link, you change the
>> onClick handler? How about this:
>>
>> <a href="image.jsp?mult=1" id='submitButton1'
>> onclick="return false;"
>> class="buttonRedSmall"><span>Submit Form</span></a>
>
> The goal of the original code is to change the onclick handler such that
> on the *second* click, the handler returns false and so stops the
> action, theoretically preventing the multiple click stream problem.
That's fine, but the onclick handler doesn't do anything but disable
itself upon the first click. Perhaps this is a toy example and not the
real thing. Again, this link does not submit a form in the first place
unless a lot of information has been removed.
I've toyed with things like this (mostly by disabling form submit
buttons) but I've always been worried that something will interrupt the
submission process itself, leaving a user with a form that will never
submit again. :(
I'd love to hear some clever solutions to this problem. I started
writing a javascript function that would disable the submit button, then
schedule it to be re-enabled in, say, 30 seconds, but it was a bit fragile.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkv1QMgACgkQ9CaO5/Lv0PA15wCgrqJhjo2w+xlcuYZwxnLX7/1l
GLQAoKd31cKOBb99T2TxlZK2PRyil07a
=xhnm
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: multiple form submits
Posted by Pid <pi...@pidster.com>.
On 17/05/2010 21:07, Christopher Schultz wrote:
> Karthik,
>
> On 5/13/2010 3:45 AM, Karthik Nanjangude wrote:
>> Question : My web application uses "href" & "css based image's"
>> for transferring the request from 1 page to another The problem is
>> UserVisitor is clicking the image based href MULTIPLE TIMES (
>> multiple clicks )
>
> Ok.
>
>> <a href="image.jsp?mult=1" id='submitButton1'
>> onClick="this.onclick=function(){return false}" target="_self"
>> class="buttonRedSmall"><span>Submit Form</span></a></td>
>
> That's a nasty construct: when the user clicks the link, you change the
> onClick handler? How about this:
>
> <a href="image.jsp?mult=1" id='submitButton1'
> onclick="return false;"
> class="buttonRedSmall"><span>Submit Form</span></a>
The goal of the original code is to change the onclick handler such that
on the *second* click, the handler returns false and so stops the
action, theoretically preventing the multiple click stream problem.
p
> BTW, the default target is "_self", so there's no need to specify that.
>
> Unless there is more Javascript that you haven't posted, the above does
> not submit a form.
>
>> And causes the multiple form submits. How to prevent the same ?
>
> Do you mean that it loads the URL twice?
>
>> I googled / yahooed for Cross browser based tricks to disable the
>> multiple request...Not luck so far ...
>
>> Can some body help me if Tomcat has any special features to prevent
>> this attack ....... :(
>
> Please post some HTML code which shows a form submission and maybe we
> can help. Note that this isn't exactly an "attack".
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: multiple form submits
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Karthik,
On 5/13/2010 3:45 AM, Karthik Nanjangude wrote:
> Question : My web application uses "href" & "css based image's"
> for transferring the request from 1 page to another The problem is
> UserVisitor is clicking the image based href MULTIPLE TIMES (
> multiple clicks )
Ok.
> <a href="image.jsp?mult=1" id='submitButton1'
> onClick="this.onclick=function(){return false}" target="_self"
> class="buttonRedSmall"><span>Submit Form</span></a></td>
That's a nasty construct: when the user clicks the link, you change the
onClick handler? How about this:
<a href="image.jsp?mult=1" id='submitButton1'
onclick="return false;"
class="buttonRedSmall"><span>Submit Form</span></a>
BTW, the default target is "_self", so there's no need to specify that.
Unless there is more Javascript that you haven't posted, the above does
not submit a form.
> And causes the multiple form submits. How to prevent the same ?
Do you mean that it loads the URL twice?
> I googled / yahooed for Cross browser based tricks to disable the
> multiple request...Not luck so far ...
>
> Can some body help me if Tomcat has any special features to prevent
> this attack ....... :(
Please post some HTML code which shows a form submission and maybe we
can help. Note that this isn't exactly an "attack".
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkvxogEACgkQ9CaO5/Lv0PAz4QCbBtTKYrr0tUk2dDckWbQ3L6yD
NtAAn034OtDLMa9IF+NO7VOVgfpS/eKg
=yKxU
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org