How to do a redirect after POST

Continuing an StackOverflow answer:

Its a little non-obvious but:

1. create a keyed-object in the user session.
2. the value is a Request + java Future for the result
3. return immediately with a client-side redirect.
4. while the client-side redirect is being handled, have a worker thread work on producing the answer.

By the time the client browser completes the redirect, getting the new page’s images, etc… the results are waiting for the user.

The alternative is to make the user painfully aware of how long the database is taking.

*Security Update (2011 Jan 24 ) :*

The key is vulnerable to attack since it is part of the response to the client, so

1. Generate a random key
2. Use user’s session id as a salt to create a SHA-1
3. Store both the random key and the SHA-1 in the database with (, ) as the primary key. (no separate indexing on just the RANDOMKEY.)
4. Use both RANDOMKEY and the SHA-1 as the db lookup.
5. Do not store the Session Id (avoid privacy issues with being able to corollate many entries to the same user)
6. Expire the results after 2-3 days. ( Allows a daily batch job to do the clean up and avoids creating problems for user sessions that are semi-long lasting )

This method requires any hacker to know both the session id and the random key.

This approach may seem overkill, but a redirect-hardened mechanism can be used for situations like password resets.

A purely random result key is highly problematic because of the high (and untested) impact of any collisions. I pick so strongly on this point because:

1. the developer is lulled into complacency about the actual collision rate
2. the impact of a collisions is unknown and probably untested
3. when/if a problem shows up:
   1. it will be in production
   2. the problem will be intermittent
   3. difficult to reproduce
   4. be disguised as another issue
   5. possibly cause data corruption
   6. possibly result in private user data being exposed
   7. difficult to retroactively correct.