Member Avatar for Nfurman

Hello. I am constructing feedback form

- SMTP
- ADO
- Captcha

OK. Everything works fine to me. Except one important thing. After smtp and sql injection and Reset(), user can hit back in browser and after that resend message. that's not good. How to make the data in form not to be accessible twice?

Perhaps, somebody can link me to some useful resource?

Edited by Nfurman because: n/a
  • 2 Contributors
  • 2 Replies
  • 113 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Nfurman

Dani AI

Generated

Good progress so far — client-side tricks can help, but they are brittle. pointed at browser/cache options and found a JavaScript "no-back" workaround; those reduce accidental resubmits but won't stop a determined user (or a network retry) and should not be your only defence.

A reliable approach combines three things:

  • Use Post/Redirect/Get (PRG) so a successful POST is followed by a redirect to a confirmation page. That prevents the browser "resend POST on refresh" dialog and breaks the simple back/refresh resubmit loop. See the Post/Redirect/Get pattern for details: Post/Redirect/Get.
  • Enforce one-time submission server-side with a token/nonce: issue a GUID when rendering the form, store it server-side (Session or a short-lived store) and emit it in a hidden field. On POST, accept the token only once and then remove/mark it used. This is simple and effective; do not rely on client-only measures.
  • Protect the database: enforce deduplication rules (unique index or hashing of key fields) and handle duplicate-key errors gracefully so a second submit cannot create a duplicate record.

Minimal example of the token idea (conceptual):

/* GET: render form */
var token = Guid.NewGuid().ToString();
Session["formToken"] = token;
/* include hidden input with that token */

/* POST: process */
var posted = Request.Form["formToken"];
if (posted==null || posted != (string)Session["formToken"]) { reject; }
else {
  Session.Remove("formToken");
  // insert + send email then Response.Redirect("thanks.aspx");
}

Additional practical tips: disable the Submit button after first click for UX (but still validate server-side), log and handle duplicate attempts, and test using back/refresh/multi-tab scenarios. For token-related security practices, OWASP guidance is useful: OWASP CSRF Prevention Cheat Sheet.

Recommended Answers

All 2 Replies

Member Avatar for kvprajapati

>How to make the data in form not to be accessible twice?

Golden rule:
1. Turn off autocomplete.
2. Disabled the response cache.
3. Disabled the viewState.

Member Avatar for Nfurman

Unfortunately, this approach doesn't work for me.
I've found other way to do it. Just put in master page in <head>
the next code

<script type="text/javascript">
function noBack(){window.history.forward();}
noBack();
window.onload=noBack;
window.onpageshow=function(evt){if(evt.persisted)noBack();}
window.onunload=function(){void(0);}
</script>

And it works!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.