Question

I’m looking for a method or current API that allows you to add on tokens to web app requests.
Maybe within the session but not persisted.
Or if you could help me by outlining an efficient method for doing this

E.g.

1. GET request => Servlet generates a token and prints it in the view

2. returns a view with a hidden token

<input type="hidden" name="token" value="UA37jdjs9UDJS3">
<input type="submit" name="deleteEmail" value="Delete">

3. POST request => form is submitted and checks if the token is the same.

Few things to note, If there are Ajax requests then some other tokens would have to be alive for a number of requests.

If the user decides to close the browser, the token would have to die when the session
is timed-out.

If the user fails to complete the form, goes off to do something else on the site,
those tokens would have to be deleted as they go unused.

But what is the best way of implementing a system like this,

Does Spring Security 3 have a system that i can use?

within the Java,Grails,Spring MVC, Spring Security 3 and Hibernate area

Answer 1

Did you take a look at “Synchronizer Token Pattern” in the Grails documentation at http://grails.org/doc/1.2.0/guide/single.html ?