We do have some Cross-Site Request Forgery support in Play, which includes special fields in every form, but we don't verify them on the server. We should call Controller.checkAuthenticity on every POST action.
I think we would be good if we did that in MyController in a @Before method for every non-GET|HEAD|OPTIONS method. We need to check that we don't have controllers that don't extend MyController and to verify that the check works by trying to fake the hidden form value or remove it.
We do have some Cross-Site Request Forgery support in Play, which includes special fields in every form, but we don't verify them on the server. We should call
Controller.checkAuthenticity
on every POST action.I think we would be good if we did that in
MyController
in a@Before
method for every non-GET|HEAD|OPTIONS
method. We need to check that we don't have controllers that don't extendMyController
and to verify that the check works by trying to fake the hidden form value or remove it.