Overcome duplicate form submission in Struts

There are three parts of any struts code which we use for validation of user fields:

1) Form Bean

2) Form Action

3) Submit Action

With appropriate use of tokens in these classes we can avoid duplicate form submission, a vector for Cross Site Request Forgery (CSRF of XSRF).

Where to use:
1) Inside Form Bean:
   Right after instantiating Action Error inside Validate() method write below lines:

   String token =request.getParameter("org.apache.struts.taglib.html.TOKEN");
    if(isToken!==null)
        {
              //write your validation code here
         }
2) Inside Form Action:
    Right after instantiating FormBean, put below line:
         saveToken(request);

3) Now, the turn of Submit Action:
     isTokenValid(request)
        {
           //Write all your valitaion code here
        }
    Close the loop and put a suitable redirect in case validation fails.

4) The knotty stuffs needed now
 > Make entry for redirection in struts.config file in case the validation fails.
 > Create a jsp with error message and make entry of this jsp in tiles.xml.
    One simple example of error.jsp:
    Unable to access the page you are looking.

crossdomain.xml, the vulnerable gateway

What is crossdomain.xml?

The crossdomain.xml file is a cross-domain policy file. It grants the Flash Player permission to talk to  servers other than the one it's hosted on. A simple example:

If your website is hosted at www.xyz.com, your crossdomain file

should look like:

 

<?xml version="1.0"?>

<cross-domain-policy>

       <allow-access-from domain="*.xyz.com" />

</cross-domain-policy>

or

<?xml version="1.0"?>

<cross-domain-policy>

    <allow-access-from domain="www.xyz.com" />    

    <allow-access-from domain="xyz.com" />

 </cross-domain-policy>

If you wanted to allow abc.org to use your server as host, add one more line like:

           <allow-access-from domain="*.xyz.com" />    

But if your file is like:

<?xml version="1.0"?>

<cross-domain-policy>

    <allow-access-from domain="*" />

</cross-domain-policy>

It is a security threat. It exposes the domain hosting. Attackers cannot only forge requests, they can read responses as well.

Where can you find this?

It is present at the root directory of host. It can be viewed like:

https://www.xyz.com/crossdomain.xml.