SecurityInnovation/TMContentReview — Issue #13: Add Unique Tokens to HTTP Requests Using Plain Java Server Pages (JSP)
Author: SergeTruth
Created: 2011-11-07 22:12:19+00:00
State: open

The code samples retrieves a random set of 12 alpha characters to use as its CSRF token. I don't think there is enough entropy in 12 alpha-numberic characters (96 bits but significantly less because the characters are limited to being alpha characters). The CSRF prevention cheat sheet recommends 256-bits of randomness. https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

The code samples do no wrap within their code block.