title: Prevent CSRF in JSF2 with client side state saving
body: <p>I'm Using MyFaces 2.2.3 with client side state saving + PrimeFaces</p>
  
  <p>After asking <a href="https://stackoverflow.com/questions/30373089/reusing-viewstate-value-in-other-session-csrf">how to prevent the re-use of a ViewState in different sessions</a> I was <a href="https://stackoverflow.com/questions/30373089/reusing-viewstate-value-in-other-session-csrf/30488762#comment49078643_30488762">told by BalusC</a> , that I can <em>inject</em> my own <em>CSRF token</em> by <em>override the from renderer to let the value be a CSRF token</em> ,</p>
  
  <p><strong>I'm looking for a solution that wont force me to modify my <em>xhtml</em> pages at all :)</strong></p>
  
  <hr>
  
  <p>BalusC has suggested a better way to prevent CSRF attack by extending <code>ViewHandlerWrapper</code> , and it works great, I only had to modify a bit the <code>restoreView</code> in the following way</p>
  
  <pre><code>public UIViewRoot restoreView(FacesContext context, String viewId) {
      UIViewRoot view = super.restoreView(context, viewId);
      if (getCsrfToken(context).equals(view.getAttributes().get(CSRF_TOKEN_KEY))) {
          return view;
      } else {
          HttpSession session = (HttpSession) context.getExternalContext().getSession(false);
          if (session != null) {
              session.invalidate(); //invalidate session so (my custom and unrelated) PhaseListener will notice that its a bad session now
          }
          try {
              FacesContext.getCurrentInstance().getExternalContext().redirect("CSRF detected and blocked"); //better looking user feedback
          } catch (IOException e) {
              e.printStackTrace();
          }
          return null;
      }
  }
  </code></pre>
  
  <hr>
  
  <p><strong>Old solution</strong></p>
  
  <p><s>
  I tried without success so far,</p>
  
  <p>Added to faces-config.xml</p>
  
  <pre><code>&lt;render-kit&gt;
      &lt;renderer&gt;
          &lt;component-family&gt;javax.faces.Form&lt;/component-family&gt;
          &lt;renderer-type&gt;javax.faces.Form&lt;/renderer-type&gt;
          &lt;renderer-class&gt;com.communitake.mdportal.renderers.CTFormRenderer&lt;/renderer-class&gt;
      &lt;/renderer&gt;
  &lt;/render-kit&gt;   
  </code></pre>
  
  <p>Then in <code>CTFormRenderer.java</code></p>
  
  <pre><code>@Override
  public void encodeEnd(FacesContext context, UIComponent arg1) throws IOException {
      //how to set form value be a CSRF token?
  }
  
  @Override
  public void decode(FacesContext context, UIComponent component) {
      HttpSession session = (HttpSession) context.getExternalContext().getSession(false);
      String token = (String) session.getAttribute(CSRFTOKEN_NAME);
      String tokenFromForm = //how to get the value stored in form value attribute because (String) component.getAttributes().get("value"); return null
      //check token against tokenFromForm...
  }
  </code></pre>
  
  <p></s></p>
  
  <p>I don't want to add a custom component to each and every <code>h:form</code>, instead I want to extend the <code>form</code> renderer so all my form will have the <code>csrf token</code>.</p>