CSRFGuard 3 Token Injection - Revision history

Eelgheez: /* Generate Link with Prevention Token */ +category

2016-06-27T21:08:26Z

‎Generate Link with Prevention Token: +category

Johanna Curiel: /* Display Token Value */

2016-06-03T22:57:20Z

‎Display Token Value

Johanna Curiel: /* Display Token Value */

2016-06-03T22:57:05Z

‎Display Token Value

Johanna Curiel: /* Display Token Name */

2016-06-03T22:51:31Z

‎Display Token Name

Esheridan at 17:45, 12 February 2011

2011-02-12T17:45:47Z

Esheridan: /* Declare and Configure JavaScriptServlet */

2011-01-04T21:18:57Z

‎Declare and Configure JavaScriptServlet

Esheridan: /* Declare and Configure JavaScriptServlet */

2010-12-18T18:30:59Z

‎Declare and Configure JavaScriptServlet

Esheridan: /* JSP Tag Library */

2010-12-16T01:35:35Z

‎JSP Tag Library

Esheridan: /* JSP Tag Library */

2010-12-16T01:32:12Z

‎JSP Tag Library

Esheridan at 23:15, 13 December 2010

2010-12-13T23:15:04Z

← Older revision		Revision as of 21:08, 27 June 2016
Line 151:		Line 151:

	<csrf:a href="protect.html">protect.html</csrf:a>		<csrf:a href="protect.html">protect.html</csrf:a>
		+
		+	[[Category:OWASP CSRFGuard Project]]

@@ Line 116: / Line 116: @@
        <input type="text" name="text" value="text"/>
        <input type="submit" name="submit" value="submit"/>
-       <input type="hidden" name="<csrf:token-name/>" value="'''<csrf:token-value/>'''"/>
+       <input type="hidden" name="<csrf:tokenname/>" value="'''<csrf:tokenvalue/>'''"/>
   </form>

@@ Line 124: / Line 124: @@
        <input type="text" name="text" value="text"/>
        <input type="submit" name="submit" value="submit"/>
-       <input type="hidden" name="<csrf:token-name/>" value="<csrf:token-value uri="protect.html"/>"/>
+       <input type="hidden" name="<csrf:tokenname/>" value="<csrf:tokenvalue uri="protect.html"/>"/>
   </form>

@@ Line 106: / Line 106: @@
        <input type="text" name="text" value="text"/>
        <input type="submit" name="submit" value="submit"/>
-       <input type="hidden" name="'''<csrf:token-name/>'''" value="<csrf:token-value/>"/>
+       <input type="hidden" name="'''<csrf:tokenname/>'''" value="<csrf:tokenvalue uri="protect.html"/>"/>
   </form>

@@ Line 11: / Line 11: @@
 == Declare and Configure JavaScriptServlet ==
-The JavaScript file used for token injection is dynamically generated by the JavaScriptServlet class using a template file. Ensure that the Owasp.CsrfGuard.jar file is found within the target application's classpath. Copy the Owasp.CsrfGuard.js template file from the OWASP CSRFGuard distribution folder to a non-publicly accessible directory within the target application. For the remainder of this section, we assume the Owasp.CsrfGuard.js template file was placed in the application's WEB-INF folder. Edit the deployment descriptor (web.xml) to declare the JavaScriptServlet class along with any associated initialization parameters. Consider the following configuration snippet taken from the [http://code.google.com/p/owaspcsrfguard/source/browse/#svn/trunk/main/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application:
+The JavaScript file used for token injection is dynamically generated by the JavaScriptServlet class using a template file. Ensure that the Owasp.CsrfGuard.jar file is found within the target application's classpath. Copy the Owasp.CsrfGuard.js template file from the OWASP CSRFGuard distribution folder to a non-publicly accessible directory within the target application. For the remainder of this section, we assume the Owasp.CsrfGuard.js template file was placed in the application's WEB-INF folder. Edit the deployment descriptor (web.xml) to declare the JavaScriptServlet class along with any associated initialization parameters. Consider the following configuration snippet taken from the [https://github.com/esheri3/OWASP-CSRFGuard/tree/master/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application:
   <servlet>
@@ Line 73: / Line 73: @@
 == Map JavaScriptServlet ==
-Developers must map the JavaScriptServlet to a URI space such that the Servlet class can be remotely accessed by the dynamic JavaScript code. Consider the following configuration snippet taken directly from the [http://code.google.com/p/owaspcsrfguard/source/browse/#svn/trunk/main/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application:
+Developers must map the JavaScriptServlet to a URI space such that the Servlet class can be remotely accessed by the dynamic JavaScript code. Consider the following configuration snippet taken directly from the [hhttps://github.com/esheri3/OWASP-CSRFGuard/tree/master/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application:
   <servlet-mapping>
@@ Line 84: / Line 84: @@
 == Inject Dynamic JavaScript ==
-Developers are required to place an HTML script tag within all pages that are known to send requests to CSRF protected resources. All requests within the current HTML page are augmented to ensure they submit the correct CSRF token for the user's current session. Note that inclusion of the dynamic JavaScript does not protect the current page. Rather, the script ensures the CSRF token is transmitted within all requests generated by the current page. Consider the following code snippet taken directly from the [http://code.google.com/p/owaspcsrfguard/source/browse/#svn/trunk/main/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application:
+Developers are required to place an HTML script tag within all pages that are known to send requests to CSRF protected resources. All requests within the current HTML page are augmented to ensure they submit the correct CSRF token for the user's current session. Note that inclusion of the dynamic JavaScript does not protect the current page. Rather, the script ensures the CSRF token is transmitted within all requests generated by the current page. Consider the following code snippet taken directly from the [https://github.com/esheri3/OWASP-CSRFGuard/tree/master/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application:
   <!-- OWASP CSRFGuard Support -->
@@ Line 93: / Line 93: @@
 = JSP Tag Library =
-OWASP CSRFGuard 3 exposes a JSP tag library providing developers more fine grain control over token injection. The library exposes JSP tags that allow access to the token name, the token value, and the token name value pair delimited by an equals (=) sign. In order to make use of the tag library, ensure the Owasp.CsrfGuard.jar file is found within the target application's classpath. For example, the [http://code.google.com/p/owaspcsrfguard/source/browse/#svn/trunk/main/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application places the OWASP CSRFGuard jar file within the WebContent/WEB-INF/lib directory. After placing the library in the classpath, developers can reference the tags in JSP pages using predefined URI reference. The following JSP code snippet imports the tag library and makes it available using the prefix "csrf":
+OWASP CSRFGuard 3 exposes a JSP tag library providing developers more fine grain control over token injection. The library exposes JSP tags that allow access to the token name, the token value, and the token name value pair delimited by an equals (=) sign. In order to make use of the tag library, ensure the Owasp.CsrfGuard.jar file is found within the target application's classpath. For example, the [https://github.com/esheri3/OWASP-CSRFGuard/tree/master/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application places the OWASP CSRFGuard jar file within the WebContent/WEB-INF/lib directory. After placing the library in the classpath, developers can reference the tags in JSP pages using predefined URI reference. The following JSP code snippet imports the tag library and makes it available using the prefix "csrf":
   <%@ taglib uri="http://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project/Owasp.CsrfGuard.tld" prefix="csrf" %>
@@ Line 101: / Line 101: @@
 == Display Token Name ==
-The OWASP CSRFGuard token name can be obtained through the token-name tag. The token-name tag is useful when injecting the CSRFGuard token name in a non-query string context. Consider the following code snippet taken from the [http://code.google.com/p/owaspcsrfguard/source/browse/#svn/trunk/main/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application. This code makes use of the token-name tag to reference the token name in the name attribute of a hidden input field:
+The OWASP CSRFGuard token name can be obtained through the token-name tag. The token-name tag is useful when injecting the CSRFGuard token name in a non-query string context. Consider the following code snippet taken from the [https://github.com/esheri3/OWASP-CSRFGuard/tree/master/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application. This code makes use of the token-name tag to reference the token name in the name attribute of a hidden input field:
   <form name="test1" action="protect.html">
@@ Line 111: / Line 111: @@
 == Display Token Value ==
-The OWASP CSRFGuard token value can be obtained through the token-value tag. The token-value tag is useful when injecting the CSRFGuard token value in a non-query string context. Consider the following code snippet taken from the [http://code.google.com/p/owaspcsrfguard/source/browse/#svn/trunk/main/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application. This code makes use of the token-value tag to reference the token value in the value attribute of a hidden input field:
+The OWASP CSRFGuard token value can be obtained through the token-value tag. The token-value tag is useful when injecting the CSRFGuard token value in a non-query string context. Consider the following code snippet taken from the [https://github.com/esheri3/OWASP-CSRFGuard/tree/master/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application. This code makes use of the token-value tag to reference the token value in the value attribute of a hidden input field:
   <form name="test1" action="protect.html">
@@ Line 129: / Line 129: @@
 == Display Token Name Value Pair ==
-The OWASP CSRFGuard token name value pair, delimited by an equals sign (=), can be obtained though the token tag. The token tag is useful when injecting the CSRFGuard token value in a query string context. Consider the following code snippet taken from the [http://code.google.com/p/owaspcsrfguard/source/browse/#svn/trunk/main/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application. This code makes use of the token tag to reference the token name value pair in the href attribute of an anchor tag:
+The OWASP CSRFGuard token name value pair, delimited by an equals sign (=), can be obtained though the token tag. The token tag is useful when injecting the CSRFGuard token value in a query string context. Consider the following code snippet taken from the [https://github.com/esheri3/OWASP-CSRFGuard/tree/master/Owasp.CsrfGuard.Test Owasp.CsrfGuard.Test] application. This code makes use of the token tag to reference the token name value pair in the href attribute of an anchor tag:
   <a href="protect.html?<csrf:token/>">protect.html</a>

@@ Line 17: / Line 17: @@
        <servlet-class>org.owasp.csrfguard.servlet.JavaScriptServlet</servlet-class>
        <init-param>
-           <param-name>source-file</param-name>
+          <param-name>source-file</param-name>
-           <param-value>WEB-INF/Owasp.CsrfGuard.js</param-value>
+          <param-value>WEB-INF/Owasp.CsrfGuard.js</param-value>
        </init-param>
        <init-param>
-           <param-name>inject-into-forms</param-name>
+          <param-name>inject-into-forms</param-name>
-           <param-value>true</param-value>
+          <param-value>true</param-value>
        </init-param>
        <init-param>
-           <param-name>inject-into-attributes</param-name>
+          <param-name>inject-into-attributes</param-name>
-           <param-value>true</param-value>
+          <param-value>true</param-value>
        </init-param>
       <init-param>
-           <param-name>domain-strict</param-name>
+          <param-name>domain-strict</param-name>
-           <param-value>false</param-value>
+          <param-value>false</param-value>
       </init-param>
   </servlet>

@@ Line 49: / Line 49: @@
   domain-strict
-Boolean value that determines whether or not the dynamic JavaScript code should be strict with regards to what links it should inject the CSRF prevention token. With a value of true, the JavaScript code will only place the token in links that point to the same exact origin from which the HTML originated. With a value of false, the JavaScript code will place the token in links that contain, but may not exactly match, the originating domain.
+Boolean value that determines whether or not the dynamic JavaScript code should be strict with regards to what links it should inject the CSRF prevention token. With a value of true, the JavaScript code will only place the token in links that point to the same exact domain from which the HTML originated. With a value of false, the JavaScript code will place the token in links that not only point to the same exact domain from which the HTML originated, but sub-domains as well.
   referer-pattern

@@ Line 135: / Line 135: @@
 == Generate Form with Prevention Token ==
-The OWASP CSRFGuard JSP library implements a tag library designed specifically to generate HTML forms with the CSRF prevention token automatically embedded as a hidden field. This strategy simplifies the integration of the CSRF token, especially when using the unique token per page model (org.owasp.csrfguard.TokenPerPage). Consider the following code snippet which will produce a HTML form with an embedded CSRF token. No special care must be taken when using this flag in conjunction with the unique token per uri model:
+The OWASP CSRFGuard JSP library implements a tag library designed specifically to generate HTML forms with the CSRF prevention token automatically embedded as a hidden field. This strategy simplifies the integration of the CSRF token, especially when using the unique token per page model (org.owasp.csrfguard.TokenPerPage). The tag accepts dynamic attribute name value pairs and simply outputs them to the page. As a result, you are free to use the same attribute values made available in a standard HTML form. There is no special output encoding performed on these dynamic attributes. Take care to perform the appropriate validation and output encoding for all dynamic attributes used in conjunction with untrusted data. Consider the following code snippet which will produce a HTML form with an embedded CSRF token. No special care must be taken when using this flag in conjunction with the unique token per uri model:
   <csrf:form id="formTest2" name="formTest2" action="protect.html">
@@ Line 144: / Line 144: @@
 == Generate Link with Prevention Token ==
-The OWASP CSRFGuard JSP library implements a tag library designed specifically to generate HTML anchor tags with the CSRF prevention token automatically embedded as a query string parameter. This strategy simplifies the integration of the CSRF token, especially when using the unique token per page model (org.owasp.csrfguard.TokenPerPage). Consider the following code snippet which will produce a HTML anchor tag with an embedded CSRF token. No special care must be taken when using this flag in conjunction with the unique token per uri model:
+The OWASP CSRFGuard JSP library implements a tag library designed specifically to generate HTML anchor tags with the CSRF prevention token automatically embedded as a query string parameter. This strategy simplifies the integration of the CSRF token, especially when using the unique token per page model (org.owasp.csrfguard.TokenPerPage). The tag accepts dynamic attribute name value pairs and simply outputs them to the page. As a result, you are free to use the same attribute values made available in a standard HTML anchor. There is no special output encoding performed on these dynamic attributes. Take care to perform the appropriate validation and output encoding for all dynamic attributes used in conjunction with untrusted data. Consider the following code snippet which will produce a HTML anchor tag with an embedded CSRF token. No special care must be taken when using this flag in conjunction with the unique token per uri model:
   <csrf:a href="protect.html">protect.html</csrf:a>

@@ Line 5: / Line 5: @@
 = JavaScript DOM Manipulation =
-OWASP CSRFGuard 3 supports the ability to dynamically inject CSRF prevention tokens through the DOM all within the user's browser. This strategy is extremely valuable with regards to server-side performance as it simply requires the serving of a dynamic JavaScript file. There is little to no performance hit when the fetched dynamic JavaScript updates the browser's DOM. Making use of the JavaScript token injection solution requires the developer map a Servlet and place a JavaScript HTML tag within all pages sending requests to protected application resources. Developers are strongly encouraged to leverage the JavaScript token injection strategy by default. This strategy requires minimal effort on behalf of the developer as most of the token injection logic is automated. In the event that the JavaScript automated solution may be insufficient for a specific application context, developers should leverage the OWASP CSRFGuard JSP tag library.
+OWASP CSRFGuard 3 supports the ability to dynamically inject CSRF prevention tokens throughout the DOM currently loaded in the user's browser. This strategy is extremely valuable with regards to server-side performance as it simply requires the serving of a dynamic JavaScript file. There is little to no performance hit when the fetched dynamic JavaScript updates the browser's DOM. Making use of the JavaScript token injection solution requires the developer map a Servlet and place a JavaScript HTML tag within all pages sending requests to protected application resources. Developers are strongly encouraged to leverage the JavaScript token injection strategy by default. This strategy requires minimal effort on behalf of the developer as most of the token injection logic is automated. In the event that the JavaScript automated solution may be insufficient for a specific application context, developers should leverage the OWASP CSRFGuard JSP tag library.
 == Declare and Configure JavaScriptServlet ==
@@ Line 40: / Line 42: @@
 Consider the following for a more detailed listing of the initialization parameters supported by JavaScriptServlet:
   source-file
@@ Line 68: / Line 50: @@
 Boolean value that determines whether or not the dynamic JavaScript code should be strict with regards to what links it should inject the CSRF prevention token. With a value of true, the JavaScript code will only place the token in links that point to the same exact origin from which the HTML originated. With a value of false, the JavaScript code will place the token in links that contain, but may not exactly match, the originating domain.
   cache-control
-Allows the developer to specify the value of the Cache-Control header in the HTTP response when serving the dynamic JavaScript file. The default value is private, maxage=28800. Caching of the dynamic JavaScript file is intended to minimize traffic and improve performance. Note that the Cache-Control header is always set to "no-store" when the "Rotate" option is set to true in Owasp.CsrfGuard.properties.
+Allows the developer to specify the value of the Cache-Control header in the HTTP response when serving the dynamic JavaScript file. The default value is private, maxage=28800. Caching of the dynamic JavaScript file is intended to minimize traffic and improve performance. Note that the Cache-Control header is always set to "no-store" when either the "Rotate" "TokenPerPage" options is set to true in Owasp.CsrfGuard.properties.
   inject-into-forms