<div class="gmail_quote">On Wed, Jun 9, 2010 at 7:25 AM, Stuart Douglas <span dir="ltr"><<a href="mailto:stuart@baileyroberts.com.au">stuart@baileyroberts.com.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div style="word-wrap:break-word"><div><br></div><div>It looks like this only affects apps that use encrypted client side state saving? </div></div></blockquote><div><br></div><div>Client-side state saving is extremely vulnerable to security hacks, something Christian and I have discussed extensively. The problem is, with client-side scripting, all the trust is on the client. You've got to have something on the server (or some other trust provider) to cross reference the request or else you are just asking for trouble.</div>
<div><br></div><div>That's a lot of what the s:token tag is about...which we will be reviewing soon as we bring it into Seam 3.</div><div><br></div><div><a href="http://seamframework.org/Community/NewComponentTagStokenAimedToGuardAgainstCSRF">http://seamframework.org/Community/NewComponentTagStokenAimedToGuardAgainstCSRF</a></div>
<div><a href="http://seamframework.org/Documentation/CrossSiteRequestForgery">http://seamframework.org/Documentation/CrossSiteRequestForgery</a></div><div><br></div><div>-Dan</div><div><br></div></div>-- <br>Dan Allen<br>
Senior Software Engineer, Red Hat | Author of Seam in Action<br>Registered Linux User #231597<br><br><a href="http://mojavelinux.com">http://mojavelinux.com</a><br><a href="http://mojavelinux.com/seaminaction">http://mojavelinux.com/seaminaction</a><br>
<a href="http://www.google.com/profiles/dan.j.allen">http://www.google.com/profiles/dan.j.allen</a><br>