csrf-protection

I am researching stuff I hear regularly that when doing a webapp in JSF 2.0 you are already protected from crossite - scripting and - request forgery. The following excerpt from a SO post confirms this: In JSF 2.0 this has been improved by using a long and strong autogenerated value instead of a rather predictable sequence value and thus making it a robust CSRF prevention. Can someone provide some more detail on this? How does this autogenerated value prevent CSRF? Thanks! BalusC How does this autogenerated value prevent CSRF ? Because it cannot be guessed. So the attacker cannot hardcode it

After configuring Spring Security 3.2, _csrf.token is not bound to a request or a session object. This is the spring security config: <http pattern="/login.jsp" security="none"/> <http> <intercept-url pattern="/**" access="ROLE_USER"/> <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=1" default-target-url="/index.jsp"/> <logout/> <csrf /> </http> <authentication-manager> <authentication-provider> <user-service> <user name="test" password="test" authorities="ROLE_USER/> </user-service> </authentication-provider> </authentication-manager> The login.jsp file <form

I am using Laravel 5 for developing an app. My app is connected with VendHQ API and I am intended to get some data from VendHQ through their webhook. As per their Documentation When an event happens and triggers a webhook, we’ll send a POST request to a URL of your choosing. The POST request will be in the UTF-8 charset, and application/x-www-form-urlencoded encoding. The problem is, when they try to send a POST request to my Laravel app, no CSRF Token is added in their post request and VerifyCsrfToken middleware is looking for a token and finally it throws a TokenMismatchException . My

In angular documentation, it is mentioned that the angular httpclient will automatically send the value of cookie XSRF-TOKEN in the header X-XSRF-TOKEN of post request. Documentation link But it does not send the header for me. Here is my code Nodejs code to set the cookie router.get('/set-csrf',function(req,res,next){ res.setHeader('Set-Cookie', "XSRF-TOKEN=abc;Path=/; HttpOnly; SameSite=Strict"); res.send(); }) I have used the httpclient in app.module.ts imports: [ HttpClientModule ] ** The above code is just for debug purpose. I do not have a set-csrf endpoint. But it does not send any