Hello.
Based on what I have researched, using tokens is the best way to prevent CSRF attacks on web applications. This basically involves creating token parameters in every
jsp page of the application.
Here's my issue:
What if this fix is already implemented in the application but this scenario happens? - user accidentally closes the browser or tab of the application where he is already logged in. In other to go back, he would need to enter again in the new browser or tab, the url of where he was working (if he can remember it) or enter again the home page of the application. Wouldn't that be the same as a CSRF attack? and thus, the application not processing the request and therefore, the user would not be able to continue. If user enters again, the url in the new browser or tab, there wouldn't be any token with it, therefore the application considering it as a CSRF attack?
How does one fix this kind of scenario if there is already an existing CSRF handling in the web application.
thanks,