SecurityInnovation/TMContentReview — Issue #12: Add Unique Tokens to HTTP Requests Using Java Server Faces (JSF)
Author: SergeTruth
Created: 2011-11-07 22:11:54+00:00
State: open

The code samples retrieves a random set of 12 alpha characters to use as its CSRF token. I don't think there is enough entropy in 12 alpha-numberic characters (96 bits but significantly less because the characters are limited to being alpha characters). The CSRF prevention cheat sheet recommends 256-bits of randomness. https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

Could the logic for CSRF token processing be incorporated into a super class?

Then a managed bean would only need to extend a CSRFManagedBean class to get CSRF protection.

The code samples do no wrap within their code block.