Re: Implementing a SecureForm to avoid CSRF attacks

2014-06-11 Thread shayy
The specific panel *inside* the form is getting updated during each AJAX request, the form itself stays the same. -- View this message in context: http://apache-wicket.1842946.n4.nabble.com/Implementing-a-SecureForm-to-avoid-CSRF-attacks-tp4666175p4666187.html Sent from the Users forum mailing

Re: Implementing a SecureForm to avoid CSRF attacks

2014-06-11 Thread Sven Meier
AM, shayy wrote: The specific panel *inside* the form is getting updated during each AJAX request, the form itself stays the same. -- View this message in context: http://apache-wicket.1842946.n4.nabble.com/Implementing-a-SecureForm-to-avoid-CSRF-attacks-tp4666175p4666187.html Sent from the Users

Re: Implementing a SecureForm to avoid CSRF attacks

2014-06-11 Thread shayy
); if (!requestToken.equals(StringValue.valueOf(token))) { log.warn(Attempted unauthorized form submission); } super.onValidate(); } } -- View this message in context: http://apache-wicket.1842946.n4.nabble.com/Implementing-a-SecureForm-to-avoid-CSRF-attacks-tp4666175p4666197.html Sent from

Re: Implementing a SecureForm to avoid CSRF attacks

2014-06-11 Thread Sven Meier
))) { log.warn(Attempted unauthorized form submission); } super.onValidate(); } } -- View this message in context: http://apache-wicket.1842946.n4.nabble.com/Implementing-a-SecureForm-to-avoid-CSRF-attacks-tp4666175p4666197.html Sent from the Users forum mailing list

Re: Implementing a SecureForm to avoid CSRF attacks

2014-06-11 Thread shayy
-a-SecureForm-to-avoid-CSRF-attacks-tp4666175p4666201.html Sent from the Users forum mailing list archive at Nabble.com. - To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org For additional commands, e-mail: users-h

Re: Implementing a SecureForm to avoid CSRF attacks

2014-06-11 Thread Sven Meier
that onEvent() will both re-generate the token on the SecureForm class as well as replace the value on the HTML? Security wise, is there a reason to do that? -- View this message in context: http://apache-wicket.1842946.n4.nabble.com/Implementing-a-SecureForm-to-avoid-CSRF-attacks-tp4666175p4666201

Re: Implementing a SecureForm to avoid CSRF attacks

2014-06-11 Thread shayy
a different value! -- View this message in context: http://apache-wicket.1842946.n4.nabble.com/Implementing-a-SecureForm-to-avoid-CSRF-attacks-tp4666175p4666204.html Sent from the Users forum mailing list archive at Nabble.com

Implementing a SecureForm to avoid CSRF attacks

2014-06-10 Thread shayy
/Implementing-a-SecureForm-to-avoid-CSRF-attacks-tp4666175.html Sent from the Users forum mailing list archive at Nabble.com. - To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org For additional commands, e-mail: users-h

Re: Implementing a SecureForm to avoid CSRF attacks

2014-06-10 Thread Sven Meier
/Implementing-a-SecureForm-to-avoid-CSRF-attacks-tp4666175.html Sent from the Users forum mailing list archive at Nabble.com. - To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org For additional commands, e-mail: users-h