aramrami/OWASP-CSRFGuard — pull request #7 by mchyzer (2014-04-20 06:52:50+00:00)
Title: Several improvements for CSRF guard

1. I added a configuration provider for reloadable properties files
overlays
2. Took out the gpg maven plugin
3. added the config file in the META-INF
4. Changes based on code from Justin Edelson for a configuration
provider
5. I have options in the config file for all the configs in the web.xml.
6. Added a variable that can be used in the config to represent the
context root
7. Took the concept from Victor Yushenko to be able to have protected or
unprotected pages by regex
8. There are a handful of cases where String.replaceAll() is used when
String.replace() should be used
9. Added a way to allow HTTP methods (instead of deny)
10. You shouldn’t have to whitelist the Javascript servlet if allow GET
11. You can log the HTTP method when logging CSRF problems
12. Option to simply check to see that the referrer is the same domain
as the javascript request