All pages vulnerable to CSRF

[jdega33]

Every form in this UI is vulnerable to cross site request forgery. How can it be fixed? Is the application supposed to be automatically fixing all CSRF even in the transitive closure of plugins, via some filter/HTML modification hook? I'm new to Grails so I don't know how this is normally done (if at all).

This can trivially be fixed by wrapping every controller action in withForm.

class SomeController {
    def someAction = {
        // do stuff
    }
}

becomes

class SomeController {
    def someAction = {
        withForm {
            // do stuff
        }
    }
}

... then change all the GSP forms to attach the token.
<g:form method="post">
becomes
<g:form method="post" useToken="true">

[virtualdogbert]

I posted a suggestion of how to fix this here:
github.com//pull/20

Burt you should fix this before your Securing Grails Applications talk at Springone 2GX, if it's with my pull request, or some variation there of, or I might just have to go to that talk and heckle you(joking obviously).
http://www.springone2gx.com/conference/santa_clara/2013/09/session?id=29370

I'll also post this on the jira page because I don't think you see these comments as often.

[edwardotis]

As of May 2016, I confirmed that the latest grails 2.x version is still wide open to this attack on all provided forms.

Looks like users should override every s2ui form they intend to use and manually apply the CSRF protection described by jdega33. More details from grails guides below:

http://docs.grails.org/2.5.x/guide/security.html#securingAgainstAttacks
http://docs.grails.org/2.5.x/guide/single.html#formtokens
and
http://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html

[ddelponte]

Code has been reviewed and manually squashed/merged into master by @sdelamo