Tapestry CSRF Protection

Cross-Site-Request-Forgery (CSRF) protection for Apache Tapestry 5.

This project is based on the GSoC 2011 project hosted on Google Code: https://code.google.com/p/gsoc2011-csrf-protection/

License

This software is licensed under the Apache Software License, Version 2.0, http://www.apache.org/licenses/LICENSE-2.0.txt

Changes

• See CHANGELOG.md

Features

• Protects all component event handler (like event links, forms, etc.) against CSRF
• Adds CSRF token to all event links and adds hidden field with CSRF token to all form POSTs
• Tokens are generated on a per-session basis

Usage

Just add this module as a Maven (or Gradle or Ivy) dependency:

<dependency>
	<groupId>at.porscheinformatik.tapestry</groupId>
	<artifactId>tapestry-csrf-protection</artifactId>
	<version>${tapstry-csrf.version}</version>
</dependency>

If you have pages that should not be checked for CSRF token, then add the annotation @NotCsrfProtected.

@NotCsrfProtected
public class MyInsecurePage
{
	@Component
	private EventLink save;

	@OnEvent("save")
	void save()
	{
		// this event handler is not protected
	}
}