Java-管理令牌-Struts-多次会话

Question

I use tokens with Struts thanks to the class TokenProcessor.java. However, if a user opens a new tab, there is a conflict with the tokens because the tokens they are linked with sessions and not the class.

I try to use this : http://www.coderanch.com/t/312306/EJB-JEE/java/Synchronizer-Token-EE-pattern-book but it doesn't seem to work.

Thanks in advance for you help.

Answer 1

TokenProcessor generates and stores a token in a session attribute called "org.apache.struts.action.TOKEN" (from the constant Globals.TRANSACTION_TOKEN_KEY). This means that, as you are finding, it is not going to work if a user has multiple pages open for the same session eg if they open multiple tabs. If you need to be able to support this use case then I think you'll have to implement token checking differently.

Looks like someone submitted a patch to get round this problem (note that I haven't looked at what this does): https://issues.apache.org/jira/browse/STR-1609