Which method among the below could be used as a defense against Cross Site Request Forgery?
-
encryptHiddenField(java.lang.String value)
-
addCSRFToken(final java.lang.String href)
-
verifySecureComm(javax.servlet.http.HttpServletRequest request)
-
setSafeContentType(javax.servlet.http.HttpServletResponse response)
Cross Site Request Forgery (CSRF) prevention requires adding unpredictable tokens to requests that the server can verify. The addCSRFToken method is specifically designed for this purpose. Option A (encryption) and C (secure communication verification) address different security concerns, while D (content type) is about XSS prevention.
CSRF defenses rely on embedding an unpredictable, per-session token into links or forms so a forged cross-site request can't reproduce it; addCSRFToken(String href) does exactly this by appending the token as a parameter to a URL. The other options address different concerns: encrypting a hidden field protects tampering with form values, verifying secure communication checks transport security (HTTPS), and setting a safe content type prevents MIME-sniffing issues — none of these stop a forged request from a third-party site.