See a department of the company put forward this problem, make up a rough solution...

1. Write interceptor

/**
 * Description: Prevent duplicate submissions
 *
 * @Author liam
 * @Create Date: 2018/3/9 9:22
 */
public class AvoidReSubmitIntercepter extends HandlerInterceptorAdapter {

    private static final String SPLIT_FLAG = "_";
    private static final String AVOID_RE_SUBMIT_TOKEN_KEY = "identifier_token";

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if (checkAvoidReSubmitTokenOn(handler,AvoidReSubmitBehavior.Check)) {
            //Verify duplicate
            if (checkIsRepeatSubmit(request)) {
                //Repeated submission
                return false;
            }
        }
        return super.preHandle(request, response, handler);
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        if (checkAvoidReSubmitTokenOn(handler,AvoidReSubmitBehavior.Create)) {
            Random random = new Random();
            String uuid = UUID.randomUUID().toString().replace(SPLIT_FLAG, String.valueOf(random.nextInt(100000)));
            String tokenValue = String.valueOf(System.currentTimeMillis());
            String transferToken = uuid + SPLIT_FLAG + tokenValue;
            request.setAttribute(AVOID_RE_SUBMIT_TOKEN_KEY, transferToken);
            request.getSession(true).setAttribute(uuid, tokenValue);
        }
        super.postHandle(request, response, handler, modelAndView);
    }

    /**
    * Description: Whether to open anti weight rule
    *
    * @Author liam
    * @Create Date: 2018/3/9 10:33
    */
    private boolean checkAvoidReSubmitTokenOn(Object handler,AvoidReSubmitBehavior behavior) {
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        Method invokeMethod = handlerMethod.getMethod();
        AvoidReSubmitToken avoidReSubmitToken = invokeMethod.getAnnotation(AvoidReSubmitToken.class);
        if (avoidReSubmitToken != null && avoidReSubmitToken.behavior().equals(behavior)) {
            return true;
        }
        return false;

    }

    private boolean checkIsRepeatSubmit(HttpServletRequest request) {
        String clientToken = request.getParameter(AVOID_RE_SUBMIT_TOKEN_KEY);
        if (StringUtils.isEmpty(clientToken)) {
            clientToken = request.getParameter(AVOID_RE_SUBMIT_TOKEN_KEY);
            if (StringUtils.isEmpty(clientToken)) {
                return true;
            }
        }
        String[] clientTokensDetail = StringUtils.split(clientToken, SPLIT_FLAG);
        if (clientTokensDetail.length == 2) {
            String uuid = clientTokensDetail[0];
            String token = clientTokensDetail[1];
            String serverToken = (String) request.getSession(true).getAttribute(uuid);
            if (StringUtils.isNotEmpty(serverToken) && token.equals(serverToken)) {
                request.getSession(true).removeAttribute(uuid);
                return false;
            }
        }
        return true;
    }
}

Provide comments on opening rules:

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface AvoidReSubmitToken {

    AvoidReSubmitBehavior behavior();

}

Define two behaviors:

public enum  AvoidReSubmitBehavior {
    Create,
    Check;
}

Configuration of Interceptor:

<! -- interceptor configuration -- >
    <mvc:interceptors>
        <! -- configure Token interceptor to prevent users from repeatedly submitting data -- >
        <mvc:interceptor>
            <mvc:mapping path="/**"/>
            <bean class="liam.AvoidReSubmitIntercepter"/>
        </mvc:interceptor>
    </mvc:interceptors>

Java code usage;

    @AvoidReSubmitToken(behavior = AvoidReSubmitBehavior.Create)
    @RequestMapping("test")
    public String testPage() {
        return "form/page";
    }
    @AvoidReSubmitToken(behavior = AvoidReSubmitBehavior.Check)
    @RequestMapping("potHandler")
    public String postHandler(){
        return "ok";
    }

Page code:

<form id="" class="form-horizontal" action="${ctx}/postHandler" method="post">
        ......
        <input type="hidden" name="token" value="${identifier_token}"/>
        <!-- Note: name Must be identifier_token -->
        ......
</form>

In fact, the scheme can also verify whether the submitted data is valid, of course, the token is usually put into the read-only cache..

Pseudo code.. No test...