2

CSRF protection for a JSF based web app and Tomcat6 backend without using any external packages. Kindly help.

1 Answer 1

2

JSF has already builtin protection against CSRF by the javax.faces.ViewState hidden field which is to be linked with the state of the component tree in the server side. If this hidden field is missing or contains a wrong value, then JSF simply won't process the POST request. On JSF 1.x the key is only a bit too easy to guess, see also JSF impl issue 812 and JSF spec issue 869. This is fixed in JSF 2.1.

Your major concern should be XSS. A succesful XSS attack can form a source for a guaranteed-to-be-succesful CSRF attack. To avoid XSS, ensure that you don't redisplay user-controlled input with <h:outputText escape="false" />. Other than that, JSF will already by default escape HTML entities.

2
  • @BalusC i read a lot of CSRF questions here on stackoverflow. i'm not 100% sure, if i had understood the javax.faces.ViewState correctly... is it true, that there is NO NEED to check the State in my bean, that it's working automatically? (i have always just read from the hidden input field with the javax.faces.ViewState but in no post what i have to do in a bean)... thx
    – Joergi
    Mar 9, 2012 at 23:33
  • ok... i tested it with firebug... and i got a javax.faces.application.ViewExpiredException - ignore my question ;)
    – Joergi
    Mar 9, 2012 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.