aware_support wroteNot sure what you mean here. If you want security for your web forms add SSL to your Tomcat installation. There are threads on this forum that explain how to do this.
It's a well-known security risk. Here is the info.
Cross-Site Request Forgery (CSRF) is an attack where a malicious site sends a request to a vulnerable site where the user is currently logged in
Here is an example of a CSRF attack:
A user logs into http://www.example.com, using forms authentication.
The server authenticates the user. The response from the server includes an authentication cookie.
Without logging out, the user visits a malicious web site. This malicious site contains the following HTML form:
<h1>You Are a Winner!</h1>
<form action="http://example.com/api/account" method="post">
<input type="hidden" name="Transaction" value="withdraw" />
<input type="hidden" name="Amount" value="1000000" />
<input type="submit" value="Click Me"/>
</form>
Notice that the form action posts to the vulnerable site, not to the malicious site. This is the “cross-site” part of CSRF.
The user clicks the submit button. The browser includes the authentication cookie with the request.
The request runs on the server with the user’s authentication context, and can do anything that an authenticated user is allowed to do.
Although this example requires the user to click the form button, the malicious page could just as easily run a script that sends an AJAX request. Moreover, using SSL does not prevent a CSRF attack, because the malicious site can send an “https://” request.
Typically, CSRF attacks are possible against web sites that use cookies for authentication, because browsers send all relevant cookies to the destination web site. However, CSRF attacks are not limited to exploiting cookies. For example, Basic and Digest authentication are also vulnerable. After a user logs in with Basic or Digest authentication. the browser automatically sends the credentials until the session ends.
