Bug 466 - Cross-site Request Forgery Protection
Summary: Cross-site Request Forgery Protection
Status: CONFIRMED
Alias: None
Product: E3
Classification: Unclassified
Component: ui-main (show other bugs)
Version: ---
Hardware: All All
: P2 normal
Target Milestone: ---
Assignee: Richard Harms
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-10-11 01:28 CDT by Richard Harms
Modified: 2017-07-15 11:04 CDT (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Richard Harms 2007-10-11 01:28:26 CDT 
Something will need to be added to deal with this problem:

http://en.wikipedia.org/wiki/Cross-site_request_forgery

Examples of the problem:

http://www.oreillynet.com/onlamp/blog/2007/10/yahoo_susceptible_to_cross_sit.html
Comment 1 Richard Harms 2012-05-01 13:18:31 CDT 
A method that would be relatively simple to implement:

http://java.dzone.com/articles/preventing-csrf-java-web-apps
Comment 2 Richard Harms 2013-01-05 09:20:29 CST 
Also seriously considering HDIV (HTTP Data Integrity Validator):

http://www.hdiv.org

Has support for Struts 1.3.