IdP CSRF Defence

[Cantor, Scott]

> I guess providing whatever validation logic that is checking the token can not
> be bypassed (currently either an normal Profile Action or a SWF Listener), if
> something did go wrong and the token was not being set in the viewScope
> using an on-render tag etc. it would not be present in the view, and hence
> would fail validation when the form it is posted back.

Yes, though it's also true that "fails safe" is still "fails" and if there's no good way to get the on-render stuff working properly under some conditions, that just breaks the software.

What I observed was that on-render expressions at times failed to access the scopes reliably and variables that definitely were set would go missing. That wasn't a case of them not setting something in the view scope. but it led me to trust the whole engine less.

> That said, I quite like the idea of having a token being set in the viewScope by a
> SWF Listener, over the reliance on configuring on-render rules.

Other than the overhead and understanding exactly how it all works to know when to do what, it's certainly interesting. I need to look at the example.

-- Scott