Support for the "Synchronizer Token" pattern (avoiding double submits)
- Dominant language
- Java
- Stars
- 127
- Forks
- 59
- Avg merge
- 23h
- Merged PRs (30d)
- 7
Description
This is a very common web application problem
([http://www.javajunkies.org/index.pl?lastnode_id=3361&node_id=3355](http://www.javajunkies.org/index.pl?lastnode_id=3361&node_id=3355)) – avoiding
double submits. Struts had built-in support for this. JSF-related implementations:
* Apache Shale component:
[http://shale.apache.org/shale-core/tagreference.html](http://shale.apache.org/shale-core/tagreference.html)
* MyFaces Orchestra (patch): [https://issues.apache.org/jira/browse/ORCHESTRA-40](https://issues.apache.org/jira/browse/ORCHESTRA-40)
* JBoss Seam component (primary goal is to avoid cross-site
scripting):
[http://seamframework.org/Community/NewComponentTagStokenAimedToGuardAgainstCSRF](http://seamframework.org/Community/NewComponentTagStokenAimedToGuardAgainstCSRF)
Spring Web Flow, Struts 2, and Grails 1.1
([http://www.grails.org/1.1+Release+Notes](http://www.grails.org/1.1+Release+Notes)) also support this natively.
I'd really like to see this in JSF 2.1 at the very latest.
#### Environment
Operating System: All
Platform: All
#### Affected Versions
[2.0]
Contributor guide
Assessment
This issue has not been assessed yet.