Create an annotation CsrfProtected

[tnodev]

Hello,

I'm using tapestry-csrf-protection since many months, and I log too much CsrfException which are not login attacks.

When using tapestry-csrf-protection, all the pages are under csrf protection, except page with annotation @NotCsrfProtected.
I will prefer that all the pages are NOT under csrf protection, except page with annotation @CsrfProtected. In my case, only the login page...

Thanks, Thomas

[derkoe]

I think this would be not a good idea since the CSRF protection should be the default for a web framework (I think it should be even default in Tapestry Core).

Why wouldn't you protect all your pages (only login)?

[tnodev]

Because I log with redmine all exceptions from 60 tapestry web sites.
They are a huge number of CsrfException from googleBot, bingbot, etc... These are not attack !

So I want to protect only my login page.
Except my login page, there is nothing to protect.

Protect or not all the page seems to me a good idea. It could be a configuration choice.