Welcome to the home of the OWASP CSRFGuard Project! OWASP CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks. The OWASP CSRFGuard library is integrated through the use of a JavaEE Filter and exposes various automated and manual ways to integrate per-session or pseudo-per-request tokens into HTML. When a user interacts with this HTML, CSRF prevention tokens (i.e. cryptographically random synchronizer tokens) are submitted with the corresponding HTTP request. It is the responsibility of OWASP CSRFGuard to ensure the token is present and is valid for the current HTTP request. Any attempt to submit a request to a protected resource without the correct corresponding token is viewed as a CSRF attack in progress and is discarded. Prior to discarding the request, CSRFGuard can be configured to take one or more actions such as logging aspects of the request and redirecting the user to a landing page. The latest release enhances this strategy to support the optional verification of HTTP requests submitted using Ajax as well as the optional verification of referrer headers.
The CSRFGuard project is run by Azzeddine RAMRAMI and Istvan ALBERT-TOTH.
Add the following dependencies to your Maven POM file to use the library:
Note: for the Jakarta releases use the -jakarta
suffix in the version
.
<dependency>
<groupId>org.owasp</groupId>
<artifactId>csrfguard</artifactId>
<version>4.3.0</version>
</dependency>
<!-- Stateful web application support -->
<dependency>
<groupId>org.owasp</groupId>
<artifactId>csrfguard-extension-session</artifactId>
<version>4.3.0</version>
</dependency>
<!-- JSP TAG support -->
<dependency>
<groupId>org.owasp</groupId>
<artifactId>csrfguard-jsp-tags</artifactId>
<version>4.3.0</version>
</dependency>
mvn clean install
in the project root directorymvn pre-integration-test -Pdeploy-jsp-webapp -pl csrfguard-test/csrfguard-test-jsp
mvn -Pdeploy-jsp-webapp -pl csrfguard-test/csrfguard-test-jsp tomcat7:run
mvnDebug
to enable remote debugging, then connect your IDE to it (default port is 8000)http://localhost:8080
to open the home page of the test projectorg.owasp
;See: https://central.sonatype.org/publish/requirements/gpg/
gpg --full-gen-key
gpg --list-keys
gpg --list-secret-keys # if you've migrated your keys from another machine, make sure you have your secret key(s) imported
gpg --keyserver keys.gnupg.net --send-key <your_public_key_here> # you can define other supported key servers as well
.m2/settings.xml
snippet required for releasing:<settings xmlns="https://maven.apache.org/SETTINGS/1.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="https://maven.apache.org/SETTINGS/1.0.0
https://maven.apache.org/xsd/settings-1.0.0.xsd">
<servers>
<server>
<id>ossrh</id> <!-- the id must match with the repository id defined in distributionManagement -->
<username><!--your_oss_sonatype_username--></username>
<password><!--your_oss_sonatype_password--></password>
</server>
</servers>
<profiles>
<profile>
<id>ossrh</id>
<activation>
<activeByDefault>true</activeByDefault>
</activation>
<properties>
<gpg.passphrase><!--your_gpg_passphrase--></gpg.passphrase>
</properties>
</profile>
</profiles>
</settings>
Test signing your artifacts manually:
mvn clean verify -Psign-artifacts -Dgpg.passphrase=<your_gpg_passphrase> # should generate .asc files in the target directory
-SNAPSHOT
version: mvn clean deploy
mvn release:clean release:prepare
4.0.0
)4.0.0
)4.0.1-SNAPSHOT
)Check the created commits and tag to make sure everything looks as expected:
git log
git show HEAD
git show HEAD^
git tag -l # list tags
mvn release:rollback # or "git reset HEAD^^ --hard"
git tag -d <tag_name_to_delete>
mvn release:perform
The maven-release-plugin
executes the deploy
(default). This triggers the execution of the nexus-staging-maven-plugin
, which uploads the artifacts to the OSS Sonatype staging repository and releases them if they meet the requirements.
autoReleaseAfterClose
is set to false
)Close
the repository to trigger the validation of the uploaded componentsRelease
Upon release, the new version is published to the Central Repository, typically within 30 minutes, but updates to search can take up to 4 hours.
git push origin master
git push origin <tag_name>
You can download pre-compiled versions from: