playframework/playframework — pull request #3321 by rtyley (2014-08-21 22:26:39+00:00)
Title: CSRFFilter: Don't add CSRF tokens to responses that set cache headers

CSRFFilter conveniently provides blanket CSRF protecction, but adding CSRF tokens to cached responses could lead to users sharing CSRF tokens if the Play instance is behind a caching proxy, like a CDN.

With this change, a response is determined to be cached if it has a `Cache-Control` header that does not contain `no-cache`