Mailing-List: contact dev-help@tapestry.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tapestry development" <dev@tapestry.apache.org>
Received-SPF: pass (nike.apache.org: domain of thiagohp@gmail.com designates
 74.125.83.52 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=content-type:to:subject:references:date:mime-version
         :content-transfer-encoding:from:message-id:in-reply-to:user-agent;
        b=H7IazK0XiwEgBbIAuAp8P78jcvv82SZuM5LikAwO6ph83Q5Ll3CUpMy7MfeGWlfh1M
         iybKe/nyBDZuRBcie4o7r7jcmWUbED3kfswGCcOf7+ljCf5+NbQixwC5IQb6koyrsn8j
         VcHgWCISaMU5S059AQ4Aso1BghIET9I3Chz6Q=
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
To: "Tapestry development" <dev@tapestry.apache.org>
Subject: Re: CSRF safeguard as GSoC task?
References: <4D7E2DCA.7010205@spielviel.de>
Date: Mon, 14 Mar 2011 12:34:29 -0300
MIME-Version: 1.0
Content-Transfer-Encoding: Quoted-Printable
From: "Thiago H. de Paula Figueiredo" <thiagohp@gmail.com>
Message-ID: <op.vscavpzt18r83n@arsmachina>
In-Reply-To: <4D7E2DCA.7010205@spielviel.de>
User-Agent: Opera Mail/11.01 (Linux)

On Mon, 14 Mar 2011 12:01:30 -0300, Ulrich St=C3=A4rk <uli@spielviel.de>=
 wrote:

> I was just reviewing a Rails application when I stumbled upon Rails'  =

> authenticity_token which guards
> against CSRF. Why don't we have something like that? ;)
>
> There are several approaches to this so a student's task would be to  =

> evaluate them, discuss them
> with the community and implement the one chosen.

+1. By the way, unfortunately, I can't be a monitor this year. :(

-- =

Thiago H. de Paula Figueiredo
Independent Java, Apache Tapestry 5 and Hibernate consultant, developer,=
  =

and instructor
Owner, Ars Machina Tecnologia da Informa=C3=A7=C3=A3o Ltda.
http://www.arsmachina.com.br

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tapestry.apache.org
For additional commands, e-mail: dev-help@tapestry.apache.org