Countermeasures against continuous posting by browser back using uuid

Overview

I made a common form that transitions to input, confirmation, and completion screen, and I tried browser back measures by uuid, so make a note. Rather than the browser back itself, the purpose is to prevent the browser back to the confirmation screen from completion and posting repeatedly.

policy

Add a column to store uuid to the DB table. Then, uuid is also saved at the time of the completion screen, but if the uuid remaining in the parameter already exists in the table, it redirects to the error screen.

Implementation

1. Add column

Add a column to store the uuid.

20201003xxxxxx_add_uuid_to_sample.rb

class AddUuidToSamples < ActiveRecord::Migration[5.2]
  def change
    add_column :samples, :uuid, :string
  end
end

2. Controller

First, issue a uuid at the timing of the new action. Then, confirm and create to check if the uuid in the form does not already exist, and if it does exist, transition to the error screen.

sample_controller.rb

before_action :verify_validate, only: [:confirm, :create]

def new
  @sample_form.uuid = ::SecureRandom.uuid
end

def confirm
end

def create
  if sample_form.save
    redirect_to complete_sample_path
  else
    render :error
  end
end

private

  def sample_form
    @sample_form ||= ::SampleForm.new(Sample.new)
  end

  def verify_validate
    render :new sample_form.validate(params[:sample])
    return redirect_to error_sample_path if Sample.exists?(uuid: sample_form.uuid)
  end

3. View

Finally, put hidden_field in the view corresponding to new and confirm. The uuid is generated only by the new action, and after that, the bucket is relayed by hidden_field.

new.slim

= form_for sample_form, url: confirm_samples_path do |f|
  #abridgement
  = f.hidden_field :uuid
  = f.button 'Verification'

confirm.slim

= form_for sample_form, url: confirm_samples_path do |f|
  #abridgement
  = f.hidden_field :uuid
  = f.button 'Send'