I need to implement CSRF attack prevention using token in application that uses ajax post requests (ExtJs library) to Struts actions. How can I implement token generation and validation in such case?
可以将文章内容翻译成中文,广告屏蔽插件可能会导致该功能失效(如失效，请关闭广告屏蔽插件后再试):
问题:
回答1:
In ExtJS you can use this:
Ext.Ajax.setDefaultHeaders({ token: 'xyz' })
This operation will add header to each request you will send to server.
In server side consider using Spring Security. I recommend this solution.
The second (and not the last option) - you can write your own servlet service and filters for - authentication(service generating token) - authorization(filter for request token validation).
