GWT application runs on CSRF protected Google App Engine

Question

I am developing a GWT application running on the Google App Engine and wondering if I need to worry about faking cross-site request requests or does it automatically take care of me?

For every RPC request requiring authentication, I have the following code:

public class BookServiceImpl extends RemoteServiceServlet implements
BookService {
    public void deleteInventory(Key<Inventory> inventoryKey) throws NotLoggedInException,  InvalidStateException, NotFoundException {
        DAO dao = new DAO();
            // This will throw NotLoggedInException if user is not logged in
        User user = dao.getCurrentUser();
            // Do deletion here
    }
}

public final class DAO extends DAOBase {
    public User getCurrentUser() throws NotLoggedInException {
            currentUser = UserServiceFactory.getUserService().getCurrentUser();
            if(currentUser == null) {
                throw new NotLoggedInException();
            }
        return currentUser;
    }

I could not find the documentation on how the verification UserServiceauthenticates. Is it enough to rely on the code above or do I need more? I am new to this, but from what I understand to avoid CSRF attacks, some of the strategies are:

• adding an authentication token to the request payload, not just checking the cookie
• HTTP check Header header

, cookie, Google, , SID, Java , . , Referer.

, -? , ? , ...

Answer 1

, XSRF. GWTs RemoteServiceServlet - GWT, .

GWT 2.1 , RPC RemoteServiceServlet. - , - , .

XSRF, Lombardi Development blog. . - , 2.1 GWT. XSRF.

• GWT RPC - CSRF?
• Lombardi GWT RPC XSRF
• GWT