RichFaces and Spring Security

[strannik_2011]

Hi

I have upgraded Spring Security to 3.2.5 where csrf protection is enabled by default.

Now all my AJAX requests in RF fail with CSRF missing token error. So I had to disable csrf to make it working.

Is it possible to integrate CSRF protection into AJAX requests?

RichFaces 4.5.1

Thanks,

Sergey

[iabughosh]

Hello Sergey,

If you are using JSF 2.2 you can use its embedded feature to protect GET requests (Including Ajax calls) :

- At faces-config file add the following snippet :

<protected-views>

  <url-pattern>/your-page.xhtml</url-pattern>

</protected-views>

regards.

[strannik_2011]

Thank you, Ibrahim.

Do you mean that JSF already enables CSRF protection by default for POST requests?

[iabughosh]

Yes Sergey, JSF by default protect applications from XSS and CSRF (post request).