Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You really have to pick whether you want possible additional copies or possibly zero copies. This isn't really a problem with this particular implementation. I think it's interesting to have the possibility of additional copies versus the standard web form behavior of at-most-one copy.


> You really have to pick whether you want possible additional copies or possibly zero copies.

You really don't. You can, as mentioned above, have a hidden UUID field in the form that's used serverside to deduplicate submissions within a given timeframe.


That's not choosing between "at least once" and "[exactly] once", but rather how to deal with "at least once".


Wouldn't you also need to regenerate CSRF tokens somehow so that the second submission doesn't reuse the initial CSRF token?


That wouldn't be a successful request... if the user gets an error from your application, they know to try again.

(Or more likely and more on-topic, for the offline-friendly form if the application gets the error first, the application could be smart enough to try again...)

The UUID doesn't guarantee anything other than capability to prevent duplicate records from duplicate submissions. Something else has to be responsible to make sure the submission is not abandoned without user input, unless a 200 or other successful status is received.


Depends on how often your CSRF tokens expire. For example, Django keeps the same token for the entire session by default IIRC.


There's no reason to expire CSRF tokens after each request.


Standard web forms don't guarantee at-most-once. If the connection fails when the response is sent, the user thinks it failed and retries, submitting another request and causing another record creation.

Take a look at how Stripe guarantees at-most-once execution: https://stripe.com/blog/idempotency.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: