CSRF Filtering using GWT RequestFactoryServlet

Question

I am implementing a token based system to prevent CSRF attacks in my Request Factory based GWT App.

To implement my filter on the server side I have overridden the doPost method on RequestFactoryServlet, thus:

@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {

    String sessionToken = CsrfTokenManager.getToken(request.getSession());
    String requestToken = request.getHeader(CsrfTokenManager.CSRF_TOKEN_NAME);
    if (sessionToken.equals(requestToken)) {
        super.doPost(request, response);
    } else {
        logger.error(String.format("Received unsafe http request [%s]", getFullRequest(request)));
        response.sendError(401,"Unsafe HTTP Request");
    }
}

This works in that it does not allow requests without a valid token to be processed, and my logs contain a suitable message, but the error I get back is a 500-Internal Server Error rather than a 401.

Can anyone shed light on why this is and what I should be doing differently?

Answer 1

There is very little information provided by you on the reason for 500 internal server error. Please share the exception stack trace ( 500 internal server error would have thrown one).

Also avoid implementing a custom one if it is not based on GWT recommendation. Read this stackoverflow query on CSRF with RequestFactory.