search

oasp / oasp4js

OASP4JS deprecated repository
Apache License 2.0
9 stars 161 forks source link

Removal of CSRF token from GET requests #75 #77

Closed tomaszwawrzyniakit closed 8 years ago

oasp-ci commented 8 years ago

Can one of the admins verify this patch?

dumbNickname commented 8 years ago

Looks good, but maybe it would be possible to add a test here?

Maybe we could also add CSRF token for 'delete' requests: http://stackoverflow.com/questions/11833061/is-csrf-possible-with-put-or-delete-methods? Disclaimer: I do not know how is it currently supported by oasp4j and what are spring security defaults when it comes to delete requests.

tomaszwawrzyniakit commented 8 years ago

Added CSRF for DELETE :)