Stack Overflow
Stack Overflow

Questions tagged [protected-views]

"protected views" is a JSF 2.2 feature of declaring a specific set of views which should require a CSRF protection token on GET requests.

6 questions
13
votes
1 answer

Should be used for JSF 2.2 CSRF protection?

I am confused. I see that JSF 2.0 has implicit CSRF protection: How JSF 2.0 prevents CSRF On the other side according to the article http://www.oracle.com/webfolder/technetwork/tutorials/obe/java/JSF-CSRF-Demo/JSF2.2CsrfDemo.html we should add the…
Michael
  • 10,063
  • 18
  • 65
  • 104
5
votes
1 answer

View declared in still accessible after manipulating CSRF token

I'm exploring the new features in JSF 2.2 (pretty cool so far) but I still don't understand how Protected Views works, I created a facelet1 with a link to facelet2, like this:
CIOC
  • 1,385
  • 3
  • 19
  • 48
1
vote
0 answers

Protecting CSRF jsf 2.2 POST request

I been working in a project with JSF 2.2 and a requeriment is to pass the Acunetix vulnerabilities validation. I active protected-views (https://www.oracle.com/webfolder/technetwork/tutorials/obe/java/JSF-CSRF-Demo/JSF2.2CsrfDemo.html) but still the…
Miguel de Orue
  • 21
  • 1
  • 2
0
votes
1 answer

JSF token inconsistency

I'm currently having trouble regarding the token generated by of JSF. I added the page I want to protect in faces-config.xml /restricted/account-management/users.xhtml …
mcspiral
  • 147
  • 1
  • 10
0
votes
0 answers

Is protected-views flawed in wildfly 8.x?

In JSF 2.2 new component was introduced and more importantly along with it a way to protect pages, that leverage this functionality, from CSRF attacks. The feature is mentioned in the JSF 2.2 specification: Call…
JanM
  • 1,385
  • 1
  • 15
  • 25
0
votes
0 answers

javax.faces.application.ProtectedViewException: null when using Spring Security

I have a project running with Spring + JSF with the security managed by Spring Security. Although I have part of the integration of Spring Security already set (protected views, roles and login form) I have come to a bump in the road when trying to…
Cenobyte321
  • 469
  • 1
  • 8
  • 26