ASP: Avoid form resubmission when REFRESH clicked?

[SONYFX]

I want to show a error message if the user refreshs the form processing page(which makes the data being submmited twice), does anyone how to do it? Thanks!

 

[WobbleWobble]

I would use a session variable "submitted" and change that to true once the user pressed submit the first time.

 

[kamper]

I'm not familiar with asp, maybe someone could comment on the race condition possibility there. So if you had: (this is pseudo-code, I don't know asp, as I said)

if (submitted) {
..reject submission;
} else {
..submitted = true;
..continue with page;
}

And you obviously could have two submissions simultaneously detect no previous submission and then both set submitted = true. Granted, it's not highly likely given a session scoped variable, but is there a mechanism to deal with such a thing? Is a single statement even guaranteed to be atomic?

 

[mooncancook]

a better pratice is to have a server-side only processing page.

Form.asp --> processing.asp --> summary.asp

in processing.asp, use response.redirect to redirect to another page when finished. This way the user will never be able to go to this page and refresh it.

 

[Zugzwang152]

Originally posted by: kamper
I'm not familiar with asp, maybe someone could comment on the race condition possibility there. So if you had: (this is pseudo-code, I don't know asp, as I said)

if (submitted) {
..reject submission;
} else {
..submitted = true;
..continue with page;
}

And you obviously could have two submissions simultaneously detect no previous submission and then both set submitted = true. Granted, it's not highly likely given a session scoped variable, but is there a mechanism to deal with such a thing? Is a single statement even guaranteed to be atomic?

i dont understand this... a session should be unique to the user, therefore he would have to be refreshing twice at the same time for this to happen?

 

[kamper]

Originally posted by: Zugzwang152
i dont understand this... a session should be unique to the user, therefore he would have to be refreshing twice at the same time for this to happen?

Yes. Like I said, unlikely to be a problem, but I hate leaving holes anywhere 😛 I mean, let's say this form submission involved transfers of large sums of money, and the user knows that by doing it twice he can get that sum again for free. He may maliciously try to submit twice at the same time.

I'm not at all thinking about average joe, staring at IE and playing by the rules. I'm thinking about a real cracker who may not even be using a real browser.

 

[Zugzwang152]

Originally posted by: kamper

Originally posted by: Zugzwang152
i dont understand this... a session should be unique to the user, therefore he would have to be refreshing twice at the same time for this to happen?

Yes. Like I said, unlikely to be a problem, but I hate leaving holes anywhere 😛 I mean, let's say this form submission involved transfers of large sums of money, and the user knows that by doing it twice he can get that sum again for free. He may maliciously try to submit twice at the same time.

I'm not at all thinking about average joe, staring at IE and playing by the rules. I'm thinking about a real cracker who may not even be using a real browser.

hats off to the guy who can send the second request through the *Internet* and have it get there between the if and the else statements. 😛

 

[kamper]

Originally posted by: Zugzwang152
hats off to the guy who can send the second request through the *Internet* and have it get there between the if and the else statements. 😛

I don't give a rip how he did it or how unlikely it was. I care that I have left the hole open and given him the opportunity to exploit it. Relying on chance for your security is dumb.

Anyways, all I wanted to know is: does asp have some sort of atomic check-and-set operation for session scoped variables. I don't suppose it's particularly relevant, as it's more or less a dead language anyways. How about php?