Question: I have implemented a security system in a project I'm working on , as follows (please tell me if something is unclear in the diagram, its simple though)

![chart](https://i.stack.imgur.com/7YreU.png)

This is working exactly like it should, but if someone makes a request, and aborts it as soon as the token has been received on client side, then the active token will still be in database, and can be used maliciously by a hacker.

Although I delete the tokens from database in verifyToken step, but if the token hasn't reached it, it will still be usable. What do you guys think will be the method to dispose of the token if the request was aborted after token being issued?

Also, even if the clients gains access to a token, he can make only one request before the token is flagged invalid. But still , even one request can be highly dangerous.

***UPDATE*** : My token mechanism is as follows : 

**Sending a token :** 

1)Generate 2 random tokens : token1 and token2.

2)Generate a hash like this : token1+userid+SALT

3)Store all data in a databse.

4)Send token1, token2, and the new hash (i call it id\_hash)

**Verifying a token :** 

1)Receive token1 and token2.

2)If token2 does not match with that from database, return FALSE.

3)Get user id from session.

4)Hash it in the following order : token1(received) + userid (session) + SALT

5) Verify the newly verified hash with the id\_hash received.

6) If matches, return TRUE, else return FALSE.

This way, a user can access/change only that data which is related to his userid, and not other user's ids.
Do you guys think this is enough? Or are there flaws to this method?

I'm using PHP, and MySQL, on apache2 webserver.

Answer: 
As a stab in the dark, don't call `Graphics#dipose` on a `Graphics` context you did not create yourself explicitly

Apart from the fact the the `Graphics` context is a shared resource, used by all the components that might need to be painted within a given paint cycle, it can also prevent what ever was painted to it to be displayed on some platforms

In 15 years of professional development, I've never had reason to call `Toolkit.getDefaultToolkit().sync();`. I doubt it'll make that big a difference, I'm just saying
Check out <http://docs.oracle.com/javase/tutorial/uiswing/painting/index.html> for the recommended way to perform custom painting of swing components