Re: [seam-dev] Fwd: JSF security issue

On Wed, Jun 9, 2010 at 7:25 AM, Stuart Douglas <stuart(a)baileyroberts.com.au&gt;wrote: Client-side state saving is extremely vulnerable to security hacks, something Christian and I have discussed extensively. The problem is, with client-side scripting, all the trust is on the client. You've got to have something on the server (or some other trust provider) to cross reference the request or else you are just asking for trouble. That's a lot of what the s:token tag is about...which we will be reviewing soon as we bring it into Seam 3. http://seamframework.org/Community/NewComponentTagStokenAimedToGuardAgain... http://seamframework.org/Documentation/CrossSiteRequestForgery -Dan -- Dan Allen Senior Software Engineer, Red Hat | Author of Seam in Action Registered Linux User #231597 http://mojavelinux.com http://mojavelinux.com/seaminaction http://www.google.com/profiles/dan.j.allen