title: how to get session id in java script
body: <p>Currently I have been asked to prevent the CSRF attach in our web application.
  I am new to the web application.</p>
  
  <p>Can any one help me regarding this</p>
  
  <p>Guide line I have been given</p>
  
  <p>An easy way to implement this fix is to have every page rendered with a couple of additional hidden variables.</p>
  
  <pre><code>var1 = hmac_sha256(timestamp+session_id, secret)
  var2 = timestamp
  </code></pre>
  
  <p>On the backend, you take the timestamp and validate it by creating an hmac of the server side secret with the timestamp.  If valid, and the time has not passed, you can allow the request to continue.  This allows you to set expiration on pages and authenticate their creation so cross site request forgery attacks are mitigated.  It should not be possible to use the same valid token twice.</p>
  
  <p>I have identified the steps to do the same.</p>
  
  <ol>
  <li>To generate the session id in java script.</li>
  <li>To generate the secret key in server side ( servlet).</li>
  <li>Send the secret key to client from server ( may be in login page).</li>
  <li><p>keep the csrf token as hidden by generating through timestamp, seesion id and secret key.</p>
  
  <p><code>var $csrfToken = hmac_sha256($timestamp +$seesionId + $mySecretKey)</code></p></li>
  <li><p>Decrypt the same in server side if get the </p>
  
  <p><code>var $stringToHash = request.get('key')</code><br>
  <code>var $isValidToken = hmac_sha256($timestamp +$seesionId  + $mySecrtKey) == request.get('csrfToken')</code></p></li>
  </ol>
  
  <p>then proceed with the request handling in servlet.</p>
  
  <p>Can any one help me with code snippet.</p>