Which method among the below could be used as a defense against Cross Site Request Forgery?
-
encryptHiddenField(java.lang.String value)
-
addCSRFToken(final java.lang.String href)
-
verifySecureComm(javax.servlet.http.HttpServletRequest request)
-
setSafeContentType(javax.servlet.http.HttpServletResponse response)
The addCSRFToken() method is specifically designed to add CSRF protection tokens to links, which is the primary defense against cross-site request forgery attacks. The other methods serve different purposes: encryption, secure communication verification, and content type setting.
CSRF defenses typically work by embedding an unpredictable, per-session token into links or forms so a forged cross-site request (which can't know the token) gets rejected. addCSRFToken(href) does exactly this by attaching the token to a URL, whereas the other listed methods deal with encrypting hidden fields, verifying secure communication, or setting response content types — none of which inject the anti-CSRF token itself.