title: CSRF token generation issue
body: <p>To prevent CSRF below were the steps i have followed:</p>
  
  <p><strong>1</strong>. First time when request comes(to loginfilter) session is null, create a session add token(randome number) to this new session by using setAttribute() and redirect to login.jsp screen using <strong>dispatcher.forward</strong>.</p>
  
  <p><strong>2</strong>. in login.jsp screen use getAttribute() store the token in the hidden filed.</p>
  
  <p><strong>3</strong>. on submit of login.jsp first request will come to loginfilter, here compare the token from the request with the token in the session, if matches then proceed with  executing the action class. otherwise generate the new token for the same session and redirect to the login.jsp using <strong>sendRedirect()</strong></p>
  
  <p>when i ran the security tool on this application, i message saying "Missing one time token parameter".</p>
  
  <p>Please help me. </p>
  
  <hr>
  
  <p><strong>1.filter.java</strong></p>
  
  <pre><code>if (session == null) {
      chain.doFilter(request, response);
      return;
  }
  else {
      // validate the CSRF
      String sToken = httprequest.getSession().getAttribute("CSRF_TOKEN")
              .toString();
      String pToken = httprequest.getParameter("CSRF_TOKEN");
      System.out.println("Tokens - " + sToken + pToken);
      if (sToken.equals(pToken)) {
          chain.doFilter(request, response);
      }
      else {
          CommonUtils.updateSessionToken(session);
          /*
           * RequestDispatcher rd =
           * request.getRequestDispatcher("/login.jsp");
           * rd.forward(request, response);
           */
          httpresponse.sendRedirect("/login.jsp");
      }
  }
  </code></pre>
  
  <hr>
  
  <p><strong>2.login.jsp</strong></p>
  
  <pre><code>&lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;%
      Object token = request.getSession().getAttribute("CSRF_TOKEN");
      String tokenStr = "";
      if (token != null) {
          tokenStr = (String) token;
      }
  
      System.out.println("+tokenStr " + tokenStr);
  %&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"&gt;
  &lt;title&gt;CSRFGuard Test Application&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
      Welcome to the OWASP CSRFGuard Test Application! Where would you like
      to go?
      &lt;br /&gt;
      &lt;form action="/CSRF/helloServlet" method="post"&gt;
          &lt;input type="text" name="username" /&gt; &lt;br /&gt; &lt;input type="text"
              value="&lt;%=tokenStr%&gt;" name="CSRF_TOKEN" /&gt; &lt;input type="submit"
              value="login"&gt;
      &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <hr>
  
  <p><strong>3.web.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
      &lt;display-name&gt;CSRF&lt;/display-name&gt;
      &lt;servlet&gt;
          &lt;description&gt;
          &lt;/description&gt;
          &lt;display-name&gt;Hell0oServelt&lt;/display-name&gt;
          &lt;servlet-name&gt;HelloServelt&lt;/servlet-name&gt;
          &lt;servlet-class&gt;com.HelloServlet&lt;/servlet-class&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;HelloServelt&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/helloServlet&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;login.jsp&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  
          &lt;listener&gt;
          &lt;listener-class&gt;com.CsrfGuardHttpSessionListener&lt;/listener-class&gt;
      &lt;/listener&gt;
    &lt;filter&gt;
      &lt;filter-name&gt;LoggedInFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;com.LoggedInFilter&lt;/filter-class&gt;
    &lt;/filter&gt;
  
    &lt;filter-mapping&gt;
      &lt;filter-name&gt;LoggedInFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p><strong>4.CsrfGuardHttpSessionListener</strong></p>
  
  <hr>
  
  <pre><code>public class CsrfGuardHttpSessionListener implements HttpSessionListener {
  
      @Override
      public void sessionCreated(HttpSessionEvent event) {
          HttpSession session = event.getSession();
          System.out.println("New session id - "+session.getId());
          String tokenId = generateRandomId();
      session.setAttribute("CSRF_TOKEN", tokenId);
      System.out.println("newtoken -"+tokenId);
      }
  
      @Override
      public void sessionDestroyed(HttpSessionEvent event) {
          /** nothing to do  **/
      }
  
  }
  </code></pre>
  
  <p><strong>5.HelloServlet</strong></p>
  
  <hr>
  
  <pre><code>public class HelloServlet extends HttpServlet {
      private static final long serialVersionUID = 1L;
  
      /**
       * @see HttpServlet#HttpServlet()
       */
      public HelloServlet() {
          super();
      }
  
      /**
       * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
       */
      protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
          System.out.println("Welcome ...!");
      }
  
      @Override
      protected void doGet(HttpServletRequest req, HttpServletResponse resp)
              throws ServletException, IOException {
  
          doPost(req, resp);
      }
  }
  </code></pre>
  
  <hr>