Tapestry5CSRF

public class CSRF 
{
	private final String securityCode;
	
	public CSRF()
	{
		// Note: Change this so the security code (sid) created by a
		// secure random source (like SecureRandom)
		securityCode = Long.toString(System.currentTimeMillis());
	}
	
	public String getSecurityCode() {
		return securityCode;
	}
}

public interface CSRFFilter extends ComponentEventRequestFilter {
	/*
	 * For now we do not need any methods.
	 */
}

/**
 * ComponentEventRequestFilter that checks if the request contains the correct secureID. Without
 * a secureID the application is vulnerable to 'Cross Site Request Forgeries' (CSRF).
 * 
 * Note: This filter only protects actions (like component actions and posts). It does not protect
 * a page render request but that should not be problematic because a page render should not
 * have any side effects just render the page.
 * 
 * @author Martijn Brinkers
 *
 */
public class CSRFFilterImpl implements CSRFFilter, LinkFactoryListener
{
	public static String CSRF_SECURITY_PARAMETER = "sid";

	private final ApplicationStateManager asm;
	private final Request request;
	private final Response response;
	private final LinkFactory linkFactory;
	private final RequestPageCache requestPageCache;
	
	/*
	 * The page to redirect to when secureID is incorrect
	 */
	private final String redirectTo;
	
	public CSRFFilterImpl(ApplicationStateManager asm, Request request, Response response, 
			LinkFactory linkFactory, RequestPageCache requestPageCache, String redirectTo)
	{
		Check.notNull(asm, "asm");
		Check.notNull(request, "request");
		Check.notNull(response, "response");
		Check.notNull(linkFactory, "linkFactory");
		Check.notNull(requestPageCache, "requestPageCache");
		Check.notNull(redirectTo, "redirectTo");
		
		this.asm = asm;
		this.request = request;
		this.response = response;
		this.linkFactory = linkFactory;
		this.requestPageCache = requestPageCache;
		this.redirectTo = redirectTo;
	}
	
	private String getSecurityCode() {
		return asm.get(CSRF.class).getSecurityCode();
	}
	
	public void createdActionLink(Link link) 
	{
		link.addParameter(CSRF_SECURITY_PARAMETER, getSecurityCode());
	}

	public void createdPageLink(Link link) 
	{
		/*
		 * Page links do not need the SecureID because pages should only show the page and
		 * not have any side effects.
		 */
	}

	public void handle(ComponentEventRequestParameters parameters, 
			ComponentEventRequestHandler handler)
	throws IOException 
	{
        Page page = requestPageCache.get(parameters.getActivePageName());

        if (isCSRFProtected(page)) 
        {
        	/*
        	 * Check if the secureID is equal to the secureID in the session
        	 */
        	String secureID = request.getParameter(CSRF_SECURITY_PARAMETER);
        	
        	CSRF csrf = asm.get(CSRF.class);
        	
        	if (secureID == null || csrf == null || !csrf.getSecurityCode().equals(secureID)) 
        	{
        		/*
        		 * Illegal secure ID so redirect
        		 */
                Link link = linkFactory.createPageLink(redirectTo, false);

                response.sendRedirect(link);
                
                return;
        	}
        }
        
        /*
         * Not protected or secureID is correct so continue
         */
        handler.handle(parameters);
	}
	
	private boolean isCSRFProtected(Page page)
	{
		/*
		 * For now all actions are protected. We can always create a special Annotation when
		 * we need to specify which pages/actions are protected.
		 */
		return true;
	}
}

    public static void contributeFactoryDefaults(
            MappedConfiguration<String, String> configuration)
    {
	  // sets the page to redirect to when the sid is incorrect
        configuration.add("csrf.redirectTo", "accessdenied");
    }


    /*
     * Builds the 'Cross Site Request Forgeries' (CSRF) filter.
     * 
     * Note: must be EagerLoad'ed because we want the LinkFactory listener to be active from the
     * start.
     */
    @EagerLoad
    public static CSRFFilter buildCSRFLinkFactoryListener(ApplicationStateManager asm, 
    		Request request, Response response, LinkFactory linkFactory,
    		RequestPageCache requestPageCache, @Inject @Value("${csrf.redirectTo}") String redirectTo)
    {
    	CSRFFilterImpl filter = new CSRFFilterImpl(asm, request, response, linkFactory,
    			requestPageCache, redirectTo);
    	
    	linkFactory.addListener(filter);
    	
    	return filter;
    }
    
    public void contributeComponentEventRequestHandler(OrderedConfiguration<ComponentEventRequestFilter> configuration,
    		CSRFFilter csrfFilter)
    {
    	/*
    	 * Make sure the CSRF filter is injected before anything else
    	 */
    	configuration.add("CSRFFilter", csrfFilter, "after:UploadException", "before:Ajax");
    }