Re: CSRF protection in Tomcat 7

2014-03-25 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Akash, On 3/24/14, 5:39 PM, Akash Jain wrote: > On Mon, Mar 24, 2014 at 1:37 PM, Konstantin Kolinko > wrote: > >> 2014-03-25 0:24 GMT+04:00 Akash Jain : >>> Yes, it uses LinkedHashMap internally which is not thread >>> safe. >>> >> http://tomcat.

Re: CSRF protection in Tomcat 7

2014-03-24 Thread Akash Jain
On Mon, Mar 24, 2014 at 1:37 PM, Konstantin Kolinko wrote: > 2014-03-25 0:24 GMT+04:00 Akash Jain : > > Yes, it uses LinkedHashMap internally which is not thread safe. > > > http://tomcat.10.x6.nabble.com/CsrfPreventionFilter-LRU-cache-td2113069.html > > > > A 3 years old thread? > > The rules her

Re: CSRF protection in Tomcat 7

2014-03-24 Thread Akash Jain
On Mon, Mar 24, 2014 at 1:33 PM, Daniel Mikusa wrote: > On Mar 24, 2014, at 4:24 PM, Akash Jain wrote: > > > Yes, it uses LinkedHashMap internally which is not thread safe. > > > http://tomcat.10.x6.nabble.com/CsrfPreventionFilter-LRU-cache-td2113069.html > > First, please don't top post. The co

Re: CSRF protection in Tomcat 7

2014-03-24 Thread Konstantin Kolinko
2014-03-25 0:24 GMT+04:00 Akash Jain : > Yes, it uses LinkedHashMap internally which is not thread safe. > http://tomcat.10.x6.nabble.com/CsrfPreventionFilter-LRU-cache-td2113069.html > A 3 years old thread? The rules here: http://tomcat.apache.org/lists.html#tomcat-users -> 1. your version = ?

Re: CSRF protection in Tomcat 7

2014-03-24 Thread Daniel Mikusa
On Mar 24, 2014, at 4:24 PM, Akash Jain wrote: > Yes, it uses LinkedHashMap internally which is not thread safe. > http://tomcat.10.x6.nabble.com/CsrfPreventionFilter-LRU-cache-td2113069.html First, please don’t top post. The convention adopted by this list is to reply inline or at the bottom.

Re: CSRF protection in Tomcat 7

2014-03-24 Thread Akash Jain
Yes, it uses LinkedHashMap internally which is not thread safe. http://tomcat.10.x6.nabble.com/CsrfPreventionFilter-LRU-cache-td2113069.html On Mon, Mar 24, 2014 at 1:09 PM, Daniel Mikusa wrote: > On Mar 24, 2014, at 3:49 PM, Akash Jain wrote: > > > How can I prevent CSRF protection using Tomca

Re: CSRF protection in Tomcat 7

2014-03-24 Thread Daniel Mikusa
On Mar 24, 2014, at 3:49 PM, Akash Jain wrote: > How can I prevent CSRF protection using Tomcat 7 ? > > I have heard that tomcat 7 provides CSRF filter > http://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/filters/CsrfPreventionFilter.html Yes. The manager application uses it. You

Re: CSRF protection in Tomcat 7

2014-03-24 Thread Akash Jain
Thanks. Do you know if tomcat 7 inbuilt CSRF has nonce thread safe issue ? On Mon, Mar 24, 2014 at 12:52 PM, Rossen Stoyanchev < rstoyanc...@gopivotal.com> wrote: > Spring Security provides CSRF protection as well: > > http://docs.spring.io/spring-security/site/docs/3.2.2.RELEASE/reference/htmls

Re: CSRF protection in Tomcat 7

2014-03-24 Thread Rossen Stoyanchev
Spring Security provides CSRF protection as well: http://docs.spring.io/spring-security/site/docs/3.2.2.RELEASE/reference/htmlsingle/#csrf On Mon, Mar 24, 2014 at 3:49 PM, Akash Jain wrote: > How can I prevent CSRF protection using Tomcat 7 ? > > I have heard that tomcat 7 provides CSRF filter

CSRF protection in Tomcat 7

2014-03-24 Thread Akash Jain
How can I prevent CSRF protection using Tomcat 7 ? I have heard that tomcat 7 provides CSRF filter http://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/filters/CsrfPreventionFilter.html But is it thread safe ? Or shall we do a custom protection in our spring 3 application ?