If you are developing web applications, sooner or later you will come across something called Cross Site Request Forgery. The most common way to prevent CSRF attacks is by embedding additional, difficult-to-guess data fields, or tokens, in requests containing sensitive data.
Support for CSRF protection has been added to the MVC 1.0 specification. It goes like this:
First, enable CSRF Protection in your application configuration by setting the javax.mvc.security.CsrfProtection to eitherCsrfOptions.EXPLICIT or CsrfOptions.IMPLICIT.
Then add the CSRF token to your forms. The Csrf object is available in Expression Language as mvc.csrf .
If CsrfOptions.IMPLICIT is used, you’re done. All controller methods annotated with @POST and that consumes the media type x–www–form–urlencoded will be automatically checked for a valid CSRF token.
If CsrfOptions.EXPLICIT is used, then the @CsrfValid annotation must be added exlicitly to the methods you want the CSRF token to be validated.
And that’s all you need!