You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@struts.apache.org by Łukasz Lenart <lu...@gmail.com> on 2023/07/14 06:06:50 UTC

Re: Struts6 application having CSRF vulnerability

Gautam

Since version 6.0.0 a set of interceptors have been defined to support
CSRF, please read the following links

https://struts.apache.org/security/#resource-isolation-using-fetch-metadata
https://struts.apache.org/security/#cross-origin-isolation-with-coop-and-coep


Regards
Lukasz

czw., 13 lip 2023 o 15:11 GAUTAM PRASAD <ga...@navy.gov.in>
napisał(a):

> Hi,
>
> After scanning through OWASP - ZAP tool my application shows following
> medium level risk.
>
> Absence of Anti-CSRF Token
>
> for above ...I tried to implement token interceptor but I am not able to
> mitigate the risk and it still reflects on scanning.
>
> Kindly suggest.
>
>
> --
> Regards
> Gautam
>
> <https://amritmahotsav.nic.in/> <https://www.g20.org/>
>
>