CSRF Guard 2.2 Roadmap - Revision history

Esheridan: CSRF Guard 2x Roadmap moved to CSRF Guard 2.2 Roadmap

2008-04-05T18:01:36Z

2008-03-23T15:17:52Z

2008-03-22T15:52:39Z

2008-03-22T15:51:55Z

2008-03-21T17:47:03Z

2008-03-21T15:06:25Z

2008-02-27T21:03:04Z

‎Planned Changes

2008-02-26T02:41:15Z

‎Planned Changes

2008-02-22T21:51:57Z

‎Planned Changes

2008-02-22T21:49:22Z

‎Planned Changes

@@ Line 13: / Line 13: @@
 :# Visiting the page and clicking "refresh" is caught as a CSRF attack. Only verify the token if parameters exist in the request (optional).
 :# Allow the developer to specify where to send the user on the initial request (i.e. when the token is being created). Prevents initial CSRF attacks against unauthenticated users.
 == Planned Changes ==
@@ Line 21: / Line 22: @@
 :# Add basic JavaScript support for invocations such as "document.location" or "window.location"
 :# Optionally randomize the CSRF token parameter name.
 == Deferred Changes ==

@@ Line 12: / Line 12: @@
 :# Update the response handlers to support the various locations that an "href" and "src" attribute can be placed in the HTML 5 spec
 :# Visiting the page and clicking "refresh" is caught as a CSRF attack. Only verify the token if parameters exist in the request (optional).
 == Planned Changes ==

@@ Line 8: / Line 8: @@
 :# JavaScriptHandler now iterates over all DOM elements and puts the token in if the element is a form or has a 'src' or 'href' attribute.
 == Planned Changes ==
@@ Line 13: / Line 17: @@
 The following is a list of changes that are tentatively scheduled for the J2EE CSRFGuard 2.2 release:
 :# Modify the response handlers to only place the token in links/forms that point to our origin
 :# Add basic JavaScript support for invocations such as "document.location" or "window.location"
 :# Optionally randomize the CSRF token parameter name.

@@ Line 7: / Line 7: @@
 The following is a list of changes that have been implemented for the development version of J2EE CSRFGuard 2.2:
-TBD
+:# JavaScriptHandler now iterates over all DOM elements and puts the token in if the element is a form or has a 'src' or 'href' attribute.
 == Planned Changes ==
@@ Line 17: / Line 17: @@
 :# Modify the response handlers to only place the token in links/forms that point to our origin
 :# Update the response handlers to support the various locations that an "href" and "src" attribute can be placed in the HTML 5 spec
 :# Visiting the page and clicking "refresh" is caught as a CSRF attack. Only verify the token if parameters exist in the request (optional).
 :# Add basic JavaScript support for invocations such as "document.location" or "window.location"

@@ Line 2: / Line 2: @@
 The purpose of this article is to maintain the desired change requests for the upcoming CSRFGuard releases. If there is a particular feature that you would like to see implemented, please feel free to add it to the appropriate sections below.
 == Planned Changes ==
@@ Line 7: / Line 13: @@
 The following is a list of changes that are tentatively scheduled for the J2EE CSRFGuard 2.2 release:
 :# Allow the user to define "entry point pages" whose token is never validated but a token always gets inserted
 :# Allow the user to define "unprotected pages" that we will simply ignore. By default, all pages are "protected"
@@ Line 23: / Line 27: @@
 The following is a list of changes that were suggested but not implemented:
-TBD
+:# Port the existing configuration file to an XML based config file
 == Changes Under Consideration ==

← Older revision	Revision as of 18:01, 5 April 2008
(No difference)

@@ Line 15: / Line 15: @@
 :# Update the JavaScriptHandler to support the "embed" tag. Is there a better way to update the attributes where we don't need to know the tag name, like the HTMLParserHandler?
 :# Rebuild the project in NetBeans and create jUnit test cases where applicable
 == Deferred Changes ==