SEC-1574: Add CSRF Support

samples/concurrency-jc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -103,13 +103,16 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
+              <p class="navbar-text pull-right">
+                <c:out value="${pageContext.request.remoteUser}"/>
+              </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>
                 <li><a href="${inboxUrl}">Inbox</a></li>
                 <c:url var="composeUrl" value="/?form"/>
                 <li><a href="${composeUrl}">Compose</a></li>
-                <c:url var="logoutUrl" value="/logout"/>
-                <li><a href="${logoutUrl}">Log out</a></li>
               </ul>
             </div>
           </div>

samples/contacts-xml/contacts.gradle

@@ -22,8 +22,7 @@ dependencies {
             "javax.servlet:jstl:$jstlVersion",
             "hsqldb:hsqldb:$hsqlVersion",
             "org.slf4j:jcl-over-slf4j:$slf4jVersion",
-            "ch.qos.logback:logback-classic:$logbackVersion"
-
-    optional "net.sf.ehcache:ehcache:$ehcacheVersion"
+            "ch.qos.logback:logback-classic:$logbackVersion",
+            "net.sf.ehcache:ehcache:$ehcacheVersion"
 
 }

samples/contacts-xml/pom.xml

@@ -123,13 +123,6 @@
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
-    <dependency>
-      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>1.6.2</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
     <dependency>
       <groupId>org.apache.tomcat</groupId>
       <artifactId>tomcat-servlet-api</artifactId>
@@ -154,6 +147,12 @@
       <version>1.2</version>
       <scope>runtime</scope>
     </dependency>
+    <dependency>
+      <groupId>net.sf.ehcache</groupId>
+      <artifactId>ehcache</artifactId>
+      <version>1.6.2</version>
+      <scope>runtime</scope>
+    </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>jcl-over-slf4j</artifactId>

samples/contacts-xml/src/main/resources/applicationContext-security.xml

@@ -31,6 +31,7 @@
         <logout logout-success-url="/index.jsp"/>
         <remember-me />
         <headers/>
+        <csrf/>
         <custom-filter ref="switchUserProcessingFilter" position="SWITCH_USER_FILTER"/>
     </http>
 

samples/contacts-xml/src/main/webapp/WEB-INF/jsp/add.jsp

@@ -33,6 +33,8 @@
     <b>Please fix all errors!</b>
   </spring:hasBindErrors>
   <br><br>
+
+  <input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
   <input name="execute" type="submit" alignment="center" value="Execute">
 </form>
 <a href="<c:url value="../hello.htm"/>">Home</a>

samples/contacts-xml/src/main/webapp/WEB-INF/jsp/addPermission.jsp

@@ -13,12 +13,12 @@
       <td alignment="right" width="20%">Recipient:</td>
       <spring:bind path="addPermission.recipient">
         <td width="20%">
-		    <select name="<c:out value="${status.expression}"/>">
-		      <c:forEach var="thisRecipient" items="${recipients}">
-		        <option <c:if test="${thisRecipient.key == status.value}">selected</c:if> value="<c:out value="${thisRecipient.key}"/>">
-		        <c:out value="${thisRecipient.value}"/></option>
-			    </c:forEach>
-		    </select>
+            <select name="<c:out value="${status.expression}"/>">
+              <c:forEach var="thisRecipient" items="${recipients}">
+                <option <c:if test="${thisRecipient.key == status.value}">selected</c:if> value="<c:out value="${thisRecipient.key}"/>">
+                <c:out value="${thisRecipient.value}"/></option>
+                </c:forEach>
+            </select>
         </td>
         <td width="60%">
           <font color="red"><c:out value="${status.errorMessage}"/></font>
@@ -29,12 +29,12 @@
       <td alignment="right" width="20%">Permission:</td>
       <spring:bind path="addPermission.permission">
         <td width="20%">
-		    <select name="<c:out value="${status.expression}"/>">
-		      <c:forEach var="thisPermission" items="${permissions}">
-		        <option <c:if test="${thisPermission.key == status.value}">selected</c:if> value="<c:out value="${thisPermission.key}"/>">
-		        <c:out value="${thisPermission.value}"/></option>
-			    </c:forEach>
-		    </select>
+            <select name="<c:out value="${status.expression}"/>">
+              <c:forEach var="thisPermission" items="${permissions}">
+                <option <c:if test="${thisPermission.key == status.value}">selected</c:if> value="<c:out value="${thisPermission.key}"/>">
+                <c:out value="${thisPermission.value}"/></option>
+                </c:forEach>
+            </select>
         </td>
         <td width="60%">
           <font color="red"><c:out value="${status.errorMessage}"/></font>
@@ -47,6 +47,7 @@
     <b>Please fix all errors!</b>
   </spring:hasBindErrors>
   <br><br>
+  <input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
   <input name="execute" type="submit" alignment="center" value="Execute">
 </form>
 <p>

samples/contacts-xml/src/main/webapp/exitUser.jsp

@@ -33,6 +33,7 @@
          </td></tr>
         <tr><td colspan='2'><input name="exit" type="submit" value="Exit"></td></tr>
       </table>
+      <input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
     </form>
   </body>
 </html>

samples/contacts-xml/src/main/webapp/login.jsp

@@ -40,7 +40,7 @@
         <tr><td colspan='2'><input name="submit" type="submit"></td></tr>
         <tr><td colspan='2'><input name="reset" type="reset"></td></tr>
       </table>
-
+      <input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
     </form>
 
   </body>

samples/contacts-xml/src/main/webapp/switchUser.jsp

@@ -36,7 +36,7 @@
         <tr><td>User:</td><td><input type='text' name='j_username'></td></tr>
         <tr><td colspan='2'><input name="switch" type="submit" value="Switch to User"></td></tr>
       </table>
-
+      <input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
     </form>
 
   </body>

samples/hellomvc-jc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -103,10 +103,10 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
               <p class="navbar-text pull-right">
                 <c:out value="${pageContext.request.remoteUser}"/>
-                <c:url var="logoutUrl" value="/logout"/>
-                <a href="${logoutUrl}">Log out</a>
               </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>

samples/helloworld-jc/src/main/webapp/index.jsp

@@ -24,13 +24,14 @@
   <body>
     <div class="container">
       <h1>This is secured!</h1>
-      <c:url var="logoutUrl" value="/logout"/>
       <p>
         Hello <b><c:out value="${pageContext.request.remoteUser}"/></b>
       </p>
-      <p>
-        <a href="${logoutUrl}">Click here</a> to log out.
-      </p>
+      <c:url var="logoutUrl" value="/logout"/>
+      <form class="form-inline" action="${logoutUrl}" method="post">
+          <input type="submit" value="Log out" />
+          <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+      </form>
     </div>
   </body>
 </html>

samples/inmemory-jc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -103,13 +103,16 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
+              <p class="navbar-text pull-right">
+                <c:out value="${pageContext.request.remoteUser}"/>
+              </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>
                 <li><a href="${inboxUrl}">Inbox</a></li>
                 <c:url var="composeUrl" value="/?form"/>
                 <li><a href="${composeUrl}">Compose</a></li>
-                <c:url var="logoutUrl" value="/logout"/>
-                <li><a href="${logoutUrl}">Log out</a></li>
               </ul>
             </div>
           </div>

samples/insecuremvc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -103,6 +103,11 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
+              <p class="navbar-text pull-right">
+                <c:out value="${pageContext.request.remoteUser}"/>
+              </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>
                 <li><a href="${inboxUrl}">Inbox</a></li>

samples/jdbc-jc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -103,13 +103,16 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
+              <p class="navbar-text pull-right">
+                <c:out value="${pageContext.request.remoteUser}"/>
+              </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>
                 <li><a href="${inboxUrl}">Inbox</a></li>
                 <c:url var="composeUrl" value="/?form"/>
                 <li><a href="${composeUrl}">Compose</a></li>
-                <c:url var="logoutUrl" value="/logout"/>
-                <li><a href="${logoutUrl}">Log out</a></li>
               </ul>
             </div>
           </div>

samples/ldap-jc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -103,13 +103,16 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
+              <p class="navbar-text pull-right">
+                <c:out value="${pageContext.request.remoteUser}"/>
+              </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>
                 <li><a href="${inboxUrl}">Inbox</a></li>
                 <c:url var="composeUrl" value="/?form"/>
                 <li><a href="${composeUrl}">Compose</a></li>
-                <c:url var="logoutUrl" value="/logout"/>
-                <li><a href="${logoutUrl}">Log out</a></li>
               </ul>
             </div>
           </div>

samples/messages-jc/pom.xml

@@ -127,12 +127,6 @@
       <version>3.2.3.RELEASE</version>
       <scope>compile</scope>
     </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-core</artifactId>
-      <version>3.2.3.RELEASE</version>
-      <scope>compile</scope>
-    </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
@@ -145,6 +139,12 @@
         </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-core</artifactId>
+      <version>3.2.3.RELEASE</version>
+      <scope>compile</scope>
+    </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-instrument</artifactId>

samples/openid-jc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -104,6 +104,11 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
+              <p class="navbar-text pull-right">
+                <c:out value="${pageContext.request.remoteUser}"/>
+              </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>
                 <li><a href="${inboxUrl}">Inbox</a></li>
@@ -111,8 +116,6 @@
                 <li><a href="${composeUrl}">Compose</a></li>
                 <c:url var="userUrl" value="/user/"/>
                 <li><a href="${userUrl}">User</a></li>
-                <c:url var="logoutUrl" value="/logout"/>
-                <li><a href="${logoutUrl}">Log out</a></li>
               </ul>
             </div>
           </div>

samples/preauth-jc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -103,13 +103,16 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
+              <p class="navbar-text pull-right">
+                <c:out value="${pageContext.request.remoteUser}"/>
+              </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>
                 <li><a href="${inboxUrl}">Inbox</a></li>
                 <c:url var="composeUrl" value="/?form"/>
                 <li><a href="${composeUrl}">Compose</a></li>
-                <c:url var="logoutUrl" value="/logout"/>
-                <li><a href="${logoutUrl}">Log out</a></li>
               </ul>
             </div>
           </div>

samples/rememberme-jc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -103,13 +103,16 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
+              <p class="navbar-text pull-right">
+                <c:out value="${pageContext.request.remoteUser}"/>
+              </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>
                 <li><a href="${inboxUrl}">Inbox</a></li>
                 <c:url var="composeUrl" value="/?form"/>
                 <li><a href="${composeUrl}">Compose</a></li>
-                <c:url var="logoutUrl" value="/logout"/>
-                <li><a href="${logoutUrl}">Log out</a></li>
               </ul>
             </div>
           </div>

samples/x509-jc/src/main/webapp/WEB-INF/decorators/main.jsp

@@ -75,7 +75,7 @@
       a {
           color: green;
       }
-      .navbar-text a {
+      .navbar-form {
         margin-left: 1em;
       }
     </style>
@@ -103,13 +103,16 @@
             <c:url var="logoUrl" value="/resources/img/logo.png"/>
             <a class="brand" href="${homeUrl}"><img src="${logoUrl}" alt="Spring Security Sample"/></a>
             <div class="nav-collapse collapse">
+              <c:url var="logoutUrl" value="/logout"/>
+              <form:form class="navbar-form pull-right" action="${logoutUrl}" method="post"><input type="submit" value="Log out" /></form:form>
+              <p class="navbar-text pull-right">
+                <c:out value="${pageContext.request.remoteUser}"/>
+              </p>
               <ul class="nav">
                 <c:url var="inboxUrl" value="/"/>
                 <li><a href="${inboxUrl}">Inbox</a></li>
                 <c:url var="composeUrl" value="/?form"/>
                 <li><a href="${composeUrl}">Compose</a></li>
-                <c:url var="logoutUrl" value="/logout"/>
-                <li><a href="${logoutUrl}">Log out</a></li>
               </ul>
             </div>
           </div>