GWT RPC - Does it do enough to protect against CSRF ?

Posted by sri on Stack Overflow See other posts from Stack Overflow or by sri
Published on 2010-04-09T18:20:02Z Indexed on 2010/04/09 18:23 UTC
Read the original article Hit count: 352

Filed under:

gwt

|

gwt-rpc

|

security

|

csrf

GWT's RPC mechanism does the following things on every HTTP Request -

Sets two custom request headers - X-GWT-Permutation and X-GWT-Module-Base
Sets the content-type as text/x-gwt-rpc; charset=utf-8

The HTTP request is always a POST, and on server side GET methods throw an exception (method not supported).

Also, if these headers are not set or have the wrong value, the server fails processing with an exception "possibly CSRF?" or something to that effect.

Question is : Is this sufficient to prevent CSRF? Is there a way to set custom headers and change content type in a pure cross-site request forgery method?

© Stack Overflow or respective owner

Related posts about gwt

How to include an external jar in gwt client side?

as seen on Stack Overflow - Search for 'Stack Overflow'
I would like to use the org.apache.commons.validator.GenericValidator class in a view class of my GWT web app. I have read that I have to implicitely tell that I intend to use this external library. I thought adding the next line into my App.gwt.xml would work. <inherits name='org.apache.commons… >>> More
How to include an external jar in a GWT module?

as seen on Stack Overflow - Search for 'Stack Overflow'
I would like to use the org.apache.commons.validator.GenericValidator class in a view class of my GWT web app. I have read that I have to implicitely tell that I intend to use this external library. I thought adding the next line into my App.gwt.xml would work. <inherits name='org.apache.commons… >>> More
GWT Javascript Exception in Hosted Mode: Result of expression 'doc.getBoxObjectFor' [undefined] is

as seen on Stack Overflow - Search for 'Stack Overflow'
Anyone ever seen this exception? I'm running in hosted mode on GWT 1.6.4 on a mac. I'm using the AutoSuggest and it's throwing this exception trying to show the popup. It works fine in compiled mode, but obviously hosted mode is rather important. [ERROR] Uncaught exception escaped com.google.gwt… >>> More
error when I use GWT RPC

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello everyone... I have a problem with Eclipse when I use an RPC.. If I use a single method call it's all in the right direction but if I add a new method to handle the server I get the following error: com.google.gwt.core.client.JavaScriptException: (null): null at com.google.gwt.dev.shell… >>> More
GWT - occasional com.google.gwt.user.client.rpc.SerializationException

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello we are haunted by occasional occurences of exceptions such as: com.google.gwt.user.client.rpc.SerializationException: Type 'xxx' was not assignable to 'com.google.gwt.user.client.rpc.IsSerializable' and did not have a custom field serializer.For security purposes, this type will not be… >>> More

Related posts about gwt-rpc

gwt-RPC problem! what is the best practice on using gwt-RPC?

as seen on Stack Overflow - Search for 'Stack Overflow'
Dear all, I want draw a chart based on the date retrieve from the database by using RPC. But everytime I fail to get the result. My rpc function is working. I think is the sequence of the process. below is my class: public class TrafficPattern_1 extends GChart { TrafficPattern_1()… >>> More
Sending persisted JDO instances over GWT-RPC

as seen on Stack Overflow - Search for 'Stack Overflow'
I've just started learning Google Web Toolkit and finished writing the Stock Watcher tutorial app. Is my thinking correct that if one wants to persist a business object (like a Stock) using JDO and send it back and forth to/from the client over RPC then one has to create two separate classes for… >>> More
GWT RPC CALL TO A FUNCTION THAT RETURNS A DATATABLE OBJECT

as seen on Stack Overflow - Search for 'Stack Overflow'
i m making a rpc call in GWT which should return a DataTable object but it gives serialisable error any solution to this >>> More
Preventing browser loading indicator with Chrome + GWT-rpc.

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello. I'm writing a ajax chatting webapp, just to test working with GWT. To simulate server side push of chat messages from the server to the browser, I have a XHR request running behind. It all works fine - except on Chrome, the browser is displaying a loading icon (a spinner) because of the XHR… >>> More
Request builder call not returning when using ssl(https)

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi , I am using GWT. Currently using gwt-rpc to for login authentication. For only login purpose i want to use ssl(https) and so instead of using gwt-rpc i am trying Request Builder and calling a servlet with https. When in Servlet URL i use protocol as http the request builder works perfectly and… >>> More