esheri3/OWASP-CSRFGuard — pull request #15 by elementalvoid (2012-01-21 17:24:03+00:00)
Title: Removing CsrfGuard object from the user sessions, changing cache headers on JavascriptServlet

We came across a problem where every single session in the app server had its own CsrfGuard object. It was only ~13 Kb but after a few thousand sessions this becomes a big problem. So, I've removed the object from the sessions and created a singleton config/worker object which all sessions can use. Each sessions data is still private because all work functions are given the session/request to work on. It should be thread safe, too.

Also as a part of the above it became important that the CsrfGuard object was created and loaded before any requests could be processed. Therefore, it is now created and configured in the new CsrfGuardServletContextListener. And since the old listener was no longer aptly named it has become the CsrfGuardHttpSessionListener as that is all it deals with now. This requires an update to the app's web.xml the OWASP CsrfGuard documentation site should be updated to reflect this.

As an example of how bad this was to us, we reduced our heap usage by approximately 1Gb just by removing the CsrfGuard instance from the session.

As a side note, this could actually improve performance first by reducing memory consumption and second be reducing any potention I/O from reading the properties file many times (although it should be cached in RAM on a healty system).

There's also a minor update to the cache headers in the JavascriptServlet for compatability with old Internet Explorer versions.