[OFBIZ-10427] Add a mean to handle CSRF (CVE-2019-0235)

• Type: Sub-task
• Status: Closed
• Priority: Minor
• Resolution: Duplicate
• Affects Version/s: Trunk
• Component/s: framework
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 02/Jun/18 09:13
• Updated: 06/Apr/20 17:34
• Resolved: 13/Feb/20 06:04

Description

I already worked on that in OFBiz but without success so far: https://markmail.org/message/r245yie623cdo3wz)
The tracks I explored are:

• https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project (really not simple in OFBiz)
• https://tomcat.apache.org/tomcat-8.5-doc/config/filter.html#CSRF_Prevention_Filter/Introduction (I think preferred)

Issue Links

• is duplicated by: OFBIZ-11306 POC for CSRF Token (CVE-2019-0235)