GWT and XSRF Protection

Question

I am considering possible solutions to protect my GWT application from XSRF.

If I understand GWT solution correctly, it provides an accessible servlet that you use to create a token on the client side (when calling your RPC endpoint) and to check on the server side (when the call gets into your service).

Does this solution only support RPC calls? Of course, we need it to cover all user requests for the server?

Any other recommended XSRF solutions (I also look at OWASP CSRFGuard )?

Answer 1

I modified the GWT Sample application to protect against XSRF. This solution is approximately based on the solution presented in the GWT developer docs. http://code.google.com/p/xsrf-safe/