CSRFGuard
Last updated
Was this helpful?
Last updated
Was this helpful?
OWASP CSRFGuard is an open-source security library designed to protect Java web applications against Cross-Site Request Forgery (CSRF) attacks. It implements token-based mitigation strategies to ensure that state-changing requests originate from a trusted user session rather than a malicious source.
CSRFGuard is a Java EE filter-based library that prevents CSRF attacks by embedding unique anti-CSRF tokens into HTTP requests. These tokens validate that a request is legitimate and not triggered by an attacker.
A user logs into a secure website (e.g., a banking portal).
The user remains logged in (session is active).
A malicious website tricks the user into making an unintended state-changing request (e.g., transferring money).
The server processes the unauthorized request because it assumes the request came from the legitimate user.
Prevents Unauthorized Actions – Ensures that only legitimate user actions are processed.
Works with Java EE Web Applications – Easily integrates with Spring Boot, Spring MVC, Struts, JSF, and JSP applications.
Supports AJAX Requests – Provides JavaScript integration to secure asynchronous requests.
Configurable Token Generation – Supports session-based and per-request token strategies.
Mitigates Cross-Site Scripting (XSS)-Induced CSRF Attacks – Ensures tokens are bound to the user session.
CSRFGuard injects security tokens into HTML forms and AJAX requests. These tokens are validated on the server before processing state-changing operations.
User logs into the application → A CSRF token is generated and stored in the session.
User submits a form → CSRFGuard inserts the CSRF token into hidden form fields or request headers.
Server validates the token → If the token is valid, the request is processed.
If the token is missing/invalid → The request is rejected, preventing CSRF attacks.
For Maven Users:
Add the CSRFGuard dependency in pom.xml:
For Gradle Users:
csrfguard.propertiesCreate a configuration file csrfguard.properties under src/main/resources/:
TokenPerPage – If true, generates a new token for each page.
TokenPerRequest – If true, generates a new token per request.
SessionKey – The CSRF token's session key name.
Ajax – Enables AJAX protection.
javascript.inject – Automatically injects CSRF tokens into forms.
Action.NoToken – Specifies an action (e.g., logout) when a token is missing.