jakartaee / jakartaee/faces

Support for the "Synchronizer Token" pattern (avoiding double submits)

Open
#559 35 comments 0 reactions 1 assignee Claimed by @glassfishrobot View on GitHub
Component: Lifecycle Priority: Critical Type: New Feature
Dominant language
Java
Stars
127
Forks
59
Avg merge
23h
Merged PRs (30d)
7

Description

This is a very common web application problem
([http://www.javajunkies.org/index.pl?lastnode_id=3361&node_id=3355](http://www.javajunkies.org/index.pl?lastnode_id=3361&node_id=3355)) – avoiding
double submits. Struts had built-in support for this. JSF-related implementations:

* Apache Shale component:
[http://shale.apache.org/shale-core/tagreference.html](http://shale.apache.org/shale-core/tagreference.html)
* MyFaces Orchestra (patch): [https://issues.apache.org/jira/browse/ORCHESTRA-40](https://issues.apache.org/jira/browse/ORCHESTRA-40)
* JBoss Seam component (primary goal is to avoid cross-site
scripting):
[http://seamframework.org/Community/NewComponentTagStokenAimedToGuardAgainstCSRF](http://seamframework.org/Community/NewComponentTagStokenAimedToGuardAgainstCSRF)

Spring Web Flow, Struts 2, and Grails 1.1
([http://www.grails.org/1.1+Release+Notes](http://www.grails.org/1.1+Release+Notes)) also support this natively.

I'd really like to see this in JSF 2.1 at the very latest.
#### Environment
Operating System: All
Platform: All
#### Affected Versions
[2.0]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.