esheri3/OWASP-CSRFGuard — pull request #25 by pstibrany (2012-05-15 11:47:00+00:00)
Title: Don't create session if there is no session yet.

Requests with no associated session are enabled without any further checks. More importantly, session is not created in such case.

This is especially useful when CSRFGuard Filter is mapped to /*, and there are parts of the website, that do not require a session. Accessing such resources without this change would create a lot of unnecessary sessions (especially if clients don't handle cookies).

I'm not sure about security implications of this change, but if there is no session, I suppose there is nothing to protect, so I think it should not cause problems. Hopefully.