AsafG
cmuratori
My solution to this problem generally is to generate a GUID for the edit page, so that if you submit it twice, it's clear to the server that it's a resubmit and it drops the second one automatically.
That's generally known as a CSRF token. It's used to prevent other websites from tricking their users to POST to your website, but if you generate a unique token per page you get the double-submit prevention for free.
An additional approach is to disable the submit button after the first click.
We have CSRF, just unique per session and not per page. We could do that, but that complicates things a bit tracking and expiring them, which also means that if someone's writing something rather long, they'll have an expired token that you have to then refresh on the fly based on their other session credentials and what not.
I prefer doing that just for pages with forms, much less to keep track of, i.e. separate from the CSRF. Also, the solution I have in mind is even simpler. More on that in March after I've implemented it. Abner won't let me work on the site this month unless it's an emergency, and this occurs so rarely it doesn't qualify.