title: How to implement CSRF Filter (Java Web App with DI)
body: <p>I am attempting to implement application-wide CSRF protection using a random token generation scheme.</p>
  
  <p>1) I have already read the <a href="https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet" rel="nofollow">OWASP CSRF Prevention cheatsheet</a></p>
  
  <p>2) I attempted to use the CSRFGuard from OWASP, but am running into problems with the configuration because it doesn't seem to work as an Injectable filter (I am using Guice and Guice Servlet).</p>
  
  <p>3) I like the following approach: <a href="http://ricardozuasti.com/2012/preventing-csrf-in-java-web-apps/" rel="nofollow">http://ricardozuasti.com/2012/preventing-csrf-in-java-web-apps/</a>, which uses tokens stored in the session, but I think that I might run into scaling problems if I put a LoadingCache inside every session, is this overkill or is it just me?  Would I be better off using a large stateful loadingcache that is centralized?</p>
  
  <p>4) I know that I should use an existing solution rather than DIY security, but there doesn't seem to be any solutions that I can plug into an app that is using dependency injection.  Are there any other alternatives out there?</p>