Reusing ViewState value in other session (CSRF)
问题 I'm using a *myfaces-api-2.2.3 with javax.faces.STATE_SAVING_METHOD set to client , I got the following scenario, 1) User X logs into the system and adds user XXX (using jsf f:ajax action) , while inspecting the chrome dev tools you can see the form that being submitted along with the ViewState value. 2) Copy that ViewState value (from chrome dev tools --> network tab) --> place it into html file with form (that mimics my original add user X ) 3) Logout from user X session (session being