Silverpeas/Silverpeas-Core — pull request #451 by mmoqui (2014-01-15 08:55:28+00:00)
Title: Security token: implementation of a security mechanism based upon the synchronizer token pattern

Enhance the existing Token API in order to implement the synchronizer token pattern.
The synchronizer token is used to protect the session of the users in Silverpeas.
Because of the strong use of frames and of HTTP multi-redirections, it was not easy and straightforward to realize the security mechanism based upon the synchronizer tokens. In order the platform works correctly with a such mechanism, it was necessary to use a cookie to carry the tokens with some requests to protected web resources/tasks. Unfortunately, this cookie adds a flaw in the security wall built with the synchronizer token and it was necessary to put an additional protection on some sensible tasks (user deletion or space deletion for examples) by using in an other and explicitly way the synchronizer token.

Don't forget to integrate also the branch in SIlverpeas-Components.