SecurityInnovation/TMContentReview — Issue #11: Add Unique Tokens to HTTP Requests Using ESAPI
Author: SergeTruth
Created: 2011-11-07 22:11:34+00:00
State: open

The code samples retrieves a random set of 8 alpha-numeric characters to use as its CSRF token. I don't think there is enough entropy in 8 alpha-numberic characters (64 bits but significantly less because the characters are limited to being alpha-numeric). The CSRF prevention cheat sheet recommends 256-bits of randomness. https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet