{"id":15290835,"url":"https://github.com/owasp/www-project-csrfguard","last_synced_at":"2025-05-15T12:04:16.762Z","repository":{"id":35812288,"uuid":"208138732","full_name":"OWASP/www-project-csrfguard","owner":"OWASP","description":"The aim of this project is to protect Java applications against CSRF attacks with the use of Synchronizer Tokens","archived":false,"fork":false,"pushed_at":"2025-04-24T21:08:15.000Z","size":3937,"stargazers_count":86,"open_issues_count":11,"forks_count":48,"subscribers_count":14,"default_branch":"master","last_synced_at":"2025-05-15T12:04:10.457Z","etag":null,"topics":["csrf","csrf-protection","hacktoberfest","java","maven","owasp","security","security-tools"],"latest_commit_sha":null,"homepage":"https://owasp.org/www-project-csrfguard/","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/OWASP.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2019-09-12T20:15:53.000Z","updated_at":"2025-04-17T15:43:52.000Z","dependencies_parsed_at":"2023-11-07T03:43:44.903Z","dependency_job_id":"e1fca08c-6a75-4ab7-8243-04ee643011ec","html_url":"https://github.com/OWASP/www-project-csrfguard","commit_stats":{"total_commits":495,"total_committers":43,"mean_commits":"11.511627906976743","dds":0.6787878787878787,"last_synced_commit":"660068e90d19fc24c4f2463129af55b32a330ad7"},"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2Fwww-project-csrfguard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2Fwww-project-csrfguard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2Fwww-project-csrfguard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2Fwww-project-csrfguard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/OWASP","download_url":"https://codeload.github.com/OWASP/www-project-csrfguard/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254337612,"owners_count":22054253,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["csrf","csrf-protection","hacktoberfest","java","maven","owasp","security","security-tools"],"created_at":"2024-09-30T16:09:40.760Z","updated_at":"2025-05-15T12:04:11.745Z","avatar_url":"https://github.com/OWASP.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ccenter\u003e\n\t\u003cimg src=\"csrfguard-test/csrfguard-test-jsp/src/main/webapp/owasp_logo.png\"/\u003e\n\u003c/center\u003e\n\n# [OWASP CSRFGuard 4.x](https://owasp.org/www-project-csrfguard)\n\n[![License](https://img.shields.io/badge/license-BSD-4EB1BA.svg)](https://www.opensource.org/licenses/bsd-license.php)\n[![GitHub release](https://img.shields.io/github/release/OWASP/www-project-csrfguard)](https://github.com/OWASP/www-project-csrfguard/releases)\n[![Maven Central release](https://img.shields.io/maven-central/v/org.owasp/csrfguard)](https://search.maven.org/search?q=g:org.owasp%20AND%20a:csrfguard)\n[![OWASP Flagship](https://img.shields.io/badge/owasp-flagship-brightgreen.svg)](https://owasp.org/projects#div-flagships)\n[![Java CI](https://github.com/OWASP/www-project-csrfguard/actions/workflows/ci.yaml/badge.svg)](https://github.com/OWASP/www-project-csrfguard/actions/workflows/ci.yaml)\n[![OWASP Dependency check](https://github.com/OWASP/www-project-csrfguard/actions/workflows/dependency_check.yaml/badge.svg)](https://github.com/OWASP/www-project-csrfguard/actions/workflows/dependency_check.yaml)\n[![Snyk Security Analysis](https://github.com/OWASP/www-project-csrfguard/actions/workflows/snyk.yaml/badge.svg)](https://github.com/OWASP/www-project-csrfguard/actions/workflows/snyk.yaml)\n\n\n## Overview\n\nWelcome to the home of the OWASP CSRFGuard Project! OWASP CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.\nThe OWASP CSRFGuard library is integrated through the use of a JavaEE Filter and exposes various automated and manual ways to integrate per-session or pseudo-per-request tokens into HTML. When a user interacts\nwith this HTML, CSRF prevention tokens (i.e. cryptographically random synchronizer tokens) are submitted with the corresponding HTTP request. It is the responsibility of OWASP CSRFGuard to ensure the token is\npresent and is valid for the current HTTP request. Any attempt to submit a request to a protected resource without the correct corresponding token is viewed as a CSRF attack in progress and is discarded. Prior\nto discarding the request, CSRFGuard can be configured to take one or more actions such as logging aspects of the request and redirecting the user to a landing page. The latest release enhances this strategy to\nsupport the optional verification of HTTP requests submitted using Ajax as well as the optional verification of referrer headers.\n\n## Project Leads\n\nThe CSRFGuard project is run by [Azzeddine RAMRAMI](mailto:azzeddine.ramrami@owasp.org) and [Istvan ALBERT-TOTH](mailto:istvan.alberttoth@owasp.org).\n\n## Using with Maven\n\nAdd the following dependencies to your Maven POM file to use the library:  \n**Note**: for the [Jakarta](https://github.com/OWASP/www-project-csrfguard/tree/jakarta) releases use the `-jakarta` suffix in the `version`.\n\n```xml\n\u003cdependency\u003e\n    \u003cgroupId\u003eorg.owasp\u003c/groupId\u003e\n    \u003cartifactId\u003ecsrfguard\u003c/artifactId\u003e\n    \u003cversion\u003e4.4.0\u003c/version\u003e\n\u003c/dependency\u003e\n\n\u003c!-- Stateful web application support --\u003e\n\u003cdependency\u003e\n    \u003cgroupId\u003eorg.owasp\u003c/groupId\u003e\n    \u003cartifactId\u003ecsrfguard-extension-session\u003c/artifactId\u003e\n    \u003cversion\u003e4.4.0\u003c/version\u003e\n\u003c/dependency\u003e\n\n\u003c!-- JSP TAG support --\u003e\n\u003cdependency\u003e\n    \u003cgroupId\u003eorg.owasp\u003c/groupId\u003e\n    \u003cartifactId\u003ecsrfguard-jsp-tags\u003c/artifactId\u003e\n    \u003cversion\u003e4.4.0\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\n## Building the code\n\n1. Make sure you have [Apache Maven](https://maven.apache.org/) 3.6.3+, JDK 1.8+ and respectively JDK 11+ for Jakarta installed\n2. Clone this repository locally\n3. Build the project by running ```mvn clean install``` in the project root directory\n4. Build and run the test JSP web application by running one of the following commands:\n   ```shell\n   mvn pre-integration-test -Pdeploy-jsp-webapp -pl csrfguard-test/csrfguard-test-jsp\n   ```\n   ```bash\n   mvn -Pdeploy-jsp-webapp -pl csrfguard-test/csrfguard-test-jsp tomcat7:run\n   ```\n6. Optional: you can use ```mvnDebug``` to enable remote debugging, then connect your IDE to it (default port is 8000)\n7. Use a web browser to access ```http://localhost:8080``` to open the home page of the test project\n\n## Uploading to the Maven Central repository (for project leaders)\n\n1. Follow the [Sonatype Open-Source Project Maven Repository Usage Guide](https://docs.sonatype.org/display/Repository/Sonatype+OSS+Maven+Repository+Usage+Guide) to create a Sonatype user account;\n2. Next, [open a support request](https://issues.sonatype.org/browse/OSSRH) to get your newly created username added to the Maven groupId ```org.owasp```;\n3. The ticket must be approved by a CSRFGuard project leader or someone who already has permissions to deploy under the group and artifactId.\n4. Once the support request has been completed, follow the instructions in the Sonatype Maven repository usage guide mentioned above to upload new versions to the Maven Central repository.\n\n### GPG Key generation and distribution\nSee: https://central.sonatype.org/publish/requirements/gpg/\n\n```shell\ngpg --full-gen-key\ngpg --list-keys\ngpg --list-secret-keys # if you've migrated your keys from another machine, make sure you have your secret key(s) imported\ngpg --keyserver keys.gnupg.net --send-key \u003cyour_public_key_here\u003e # you can define other supported key servers as well\n```\n\n### Example `.m2/settings.xml` snippet required for releasing:\n\n```xml\n\u003csettings xmlns=\"https://maven.apache.org/SETTINGS/1.0.0\"\n          xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n          xsi:schemaLocation=\"https://maven.apache.org/SETTINGS/1.0.0\n                      https://maven.apache.org/xsd/settings-1.0.0.xsd\"\u003e\n    \u003cservers\u003e\n        \u003cserver\u003e\n            \u003cid\u003eossrh\u003c/id\u003e \u003c!-- the id must match with the repository id defined in distributionManagement --\u003e\n            \u003cusername\u003e\u003c!--your_oss_sonatype_username--\u003e\u003c/username\u003e\n            \u003cpassword\u003e\u003c!--your_oss_sonatype_password--\u003e\u003c/password\u003e\n        \u003c/server\u003e\n    \u003c/servers\u003e\n\n    \u003cprofiles\u003e\n        \u003cprofile\u003e\n            \u003cid\u003eossrh\u003c/id\u003e\n            \u003cactivation\u003e\n                \u003cactiveByDefault\u003etrue\u003c/activeByDefault\u003e\n            \u003c/activation\u003e\n            \u003cproperties\u003e\n                \u003cgpg.passphrase\u003e\u003c!--your_gpg_passphrase--\u003e\u003c/gpg.passphrase\u003e\n            \u003c/properties\u003e\n        \u003c/profile\u003e\n    \u003c/profiles\u003e\n\u003c/settings\u003e\n```\n\nTest signing your artifacts manually:\n```shell\nmvn clean verify -Psign-artifacts -Dgpg.passphrase=\u003cyour_gpg_passphrase\u003e # should generate .asc files in the target directory\n```\n\n### Deploying to OSS Sonatype / Maven Central\n\n#### Deploy a `-SNAPSHOT` version:\n   ```shell\n   mvn clean deploy\n   ```\n\n#### Prepare a release:\n```shell\nmvn release:clean release:prepare\n```\n1. Set the version number you want to release in \u003c_MAJOR.MINOR.PATCH_\u003e format (e.g. `4.0.0`)\n2. Set the SCM release tag: (e.g. `4.0.0`)\n3. Set the new development version (e.g. `4.0.1-SNAPSHOT`)\n\nCheck the created commits and tag to make sure everything looks as expected:\n   ```shell\n   git log\n   git show HEAD\n   git show HEAD^\n   git tag -l # list tags\n   ```\n\n#### Rollback the local release:\n```shell\nmvn release:rollback # or \"git reset HEAD^^ --hard\"\ngit tag -d \u003ctag_name_to_delete\u003e\n```\n\n#### Upload the release to OSS Sonatype (staging):\n```shell\nmvn release:perform \n```\n\nThe `maven-release-plugin` executes the `deploy` (default). This triggers the execution of the `nexus-staging-maven-plugin`, which uploads the artifacts to the [OSS Sonatype staging repository](https://oss.sonatype.org/#stagingRepositories) and releases them if they meet the requirements.\n\n### [Manual release of a staging repository](https://central.sonatype.org/publish/release/) (in case `autoReleaseAfterClose` is set to `false`)\n\n* Visit https://oss.sonatype.org/#stagingRepositories\n* Review the newly created repository against the [requirements](https://central.sonatype.org/publish/requirements/) (JAR files, sources, JavaDocs and associated PGP armored ASCII files are present with the desired version etc.)\n* `Close` the repository to trigger the validation of the uploaded components\n* If there were no errors, click `Release`\n\nUpon release, the new version is published to the Central Repository, typically within 30 minutes, but updates to [search](https://search.maven.org/) can take up to 4 hours.\n\n#### Push the new release to GitHub:\n```shell\ngit push origin master\ngit push origin \u003ctag_name\u003e\n```\n\n### Maven repositories\n\nYou can download pre-compiled versions from:\n\n* [Maven Central repository](https://search.maven.org/search?q=csrfguard)\n* [OSS Sonatype Nexus repository](https://oss.sonatype.org/#nexus-search;gav~~csrfguard~~~)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fowasp%2Fwww-project-csrfguard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fowasp%2Fwww-project-csrfguard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fowasp%2Fwww-project-csrfguard/lists"}