[ https://jira.jboss.org/jira/browse/JBSEAM-4076?page=com.atlassian.jira.pl... ] Stuart Douglas commented on JBSEAM-4076: ---------------------------------------- The way the patch works is if a user installs <security:render-stamp-store/> then rather than being stored in the view root, render stamps are stored in the session scoped RenderStampStore, and the key to access the render stamp is stored in the view root instead. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBSEAM-4076?page=com.atlassian.jira.pl... ] Dan Allen commented on JBSEAM-4076: ----------------------------------- I should clarify that this patch doesn't provide CSRF protection when using client-side state saving. That has already been guaranteed by the <s:token> design. What this patch provides is protection against a double form submit when using client-side state saving. It transfers control of the render stamp to the server so that it is possible to clear this value after the first submit. When the render stamp is stored in the view root with client-side state saving, there is no way to clear the value (since it is being delivered by the client each time). -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBSEAM-4076?page=com.atlassian.jira.pl... ] Dan Allen resolved JBSEAM-4076. ------------------------------- Resolution: Done -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira