Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Double-clicking on the Web

ma.ttias.be

Post reply on HN
Print view View original

21–30 of 109 posts

Re: Double-clicking on the Web

#21

Post by zkhalique »

jxf wrote: post #18

HTTP already handles this just fine if you have sensitive forms: your form can include a one-time token which your server validates. If the token has already been used, you don't process the second request. What we definitely shouldn't do (as the author suggests) is disable form submissions on subsequent clicks. What if the first response fails? You'll have to enter the entire form all over again, instead of being ab…

Forms should probably have a one-time token generated when the form is rendered. This will also help prevent CSRF and DDOS via hogging of resources.

In fact, the same technique should apply to session tokens in general. They should be signed by the server, which removes the need to do I/O to filter out unauthorized sessions and mitigate DDOS attacks.

So yes, this is the correct way to do it. But additionally, I don't see why it's so bad for the client to prevent quick submissions in succession... maybe disable the button until the response comes back, with a 1 second timeout, and alternate suggestions on repeated failures.

Re: Double-clicking on the Web

#22

Post by voyou »

I don't see the problem. Contrary to the post, double clicking a link doesn't open it twice, and double clicking a submit button doesn't submit the form twice; at least, not on Chrome or Firefox on Linux.

Re: Double-clicking on the Web

#23

Post by codecamper »

double clicking must die. my parents still continue to double click on almost everything they see — all because their first computer experiences were on my Mac SE. (Mac OS 5 or 6 or 3?)

plus... double click means double RSI no?

Re: Double-clicking on the Web

#24

Post by reinhardt »

denma wrote: post #3

That reminds me of the way my mother is using a computer. She clicks EVERYTHING twice. No matter if online or offline. That often causes problems. For example if you double-click an icon in the windows taskbar to open an application it opens twice.

Mine is the opposite, she never double clicks despite numerous attempts to teach her. Not sure about online but offline she "right-click + open"s everything, which is painful to watch.

Re: Double-clicking on the Web

#25

Post by seszett »

nodesocket wrote: post #9

Is it me, or why is a setTimeout needed in this example? $(document).ready(function(){ $("form").submit(function(){ setTimeout(function() { $('input').attr('disabled', 'disabled'); $('a').attr('disabled', 'disabled'); }, 50); }) });

Some browsers will not submit the form if you disable the submit input inside the submit event.

Re: Double-clicking on the Web

#26

Post by johnbennyton »

creshal wrote: post #10

Are double click actions still a thing? Windows has had an option for single-click mode since forever, and most users I know use it – mainly because they're used to single click from the web. The remainder and most Mac/Linux users don't even bother and navigate with the keyboard. I can't remember the last time I had to double-click anything, except for text selection.

There's something particularly ugly about people who feign ignorance of the way people less technical than them do things, in order to make themselves sound more elite.

Re: Double-clicking on the Web

#27

Post by buro9 »

I allow multiple form submits on my sites. What I don't do is allow the same form to be submitted twice if the checksum of values it is submitting is the same as a prior submit.

This allows for the best balance between preventing double-submission errors, and a good user experience if a user has made an error.

I still de-dupe check on the server too (in case JS is disabled), and in a distributed environment the server submissoin de-dupe check isn't guaranteed (what if two submissions went to different servers?).

Perhaps if anything should be added to browsers it's simply a checksum of all of the values to submitted and an option to prevent submission if a prior checksum has been submitted. But even then... this is trivial to do in JS.

The above only applies to POST, for GET I don't care... it's cached, and perhaps the second request is the because the first one stalled (bad mobile network, etc).

Re: Double-clicking on the Web

#28

Post by nailer »

johnbennyton wrote: post #26
creshal wrote: post #10

Are double click actions still a thing? Windows has had an option for single-click mode since forever, and most users I know use it – mainly because they're used to single click from the web. The remainder and most Mac/Linux users don't even bother and navigate with the keyboard. I can't remember the last time I had to double-click anything, except for text selection.

There's something particularly ugly about people who feign ignorance of the way people less technical than them do things, in order to make themselves sound more elite.

It's not being less technical: using double click simply means you did desktop computing in the mid nineties on Windows. Anyone younger simply doesn't have that memory.

Re: Double-clicking on the Web

#29

Post by ryanlol »

zkhalique wrote: post #21
jxf wrote: post #18

HTTP already handles this just fine if you have sensitive forms: your form can include a one-time token which your server validates. If the token has already been used, you don't process the second request. What we definitely shouldn't do (as the author suggests) is disable form submissions on subsequent clicks. What if the first response fails? You'll have to enter the entire form all over again, instead of being ab…

Forms should probably have a one-time token generated when the form is rendered. This will also help prevent CSRF and DDOS via hogging of resources. In fact, the same technique should apply to session tokens in general. They should be signed by the server, which removes the need to do I/O to filter out unauthorized sessions and mitigate DDOS attacks. So yes, this is the correct way to do it. But additionally, I don't…

So the DDoS attacker can't retrieve said tokens?

Re: Double-clicking on the Web

#30

Post by nailer »

nodesocket wrote: post #9

Is it me, or why is a setTimeout needed in this example? $(document).ready(function(){ $("form").submit(function(){ setTimeout(function() { $('input').attr('disabled', 'disabled'); $('a').attr('disabled', 'disabled'); }, 50); }) });

50 should be a constant called NEXT_TICK with a value of 0. This makes it run on the next event loop, ie, default event submit form, next tick afterwards the form is disabled
Post reply on HN