XSRF integration to the application - gwt

Question

I was trying to implement XSRF for my application. I followed the guide provided at gwtproject.org. I even setup a demo and it is working fine. As mentioned in the guide, I wrapped up async call with another async call for getting the XSRF token and everything works fine.
XsrfTokenServiceAsync xsrf = (XsrfTokenServiceAsync)GWT.create(XsrfTokenService.class);
((ServiceDefTarget)xsrf).setServiceEntryPoint(GWT.getModuleBaseURL() + "xsrf");
xsrf.getNewXsrfToken(new AsyncCallback<XsrfToken>() {
public void onSuccess(XsrfToken token) {
MyServiceAsync rpc = (MyServiceAsync)GWT.create(MyService.class);
((HasRpcToken) rpc).setRpcToken(token);
// make XSRF protected RPC call
rpc.doStuff(new AsyncCallback<Void>() {
// ...
});
}
public void onFailure(Throwable caught) {
try {
throw caught;
} catch (RpcTokenException e) {
// Can be thrown for several reasons:
// - duplicate session cookie, which may be a sign of a cookie
// overwrite attack
// - XSRF token cannot be generated because session cookie isn't
// present
} catch (Throwable e) {
// unexpected
}
});
My question: Should I make two async calls for every async call to make is XSRF secure, i.e., One to get the XSRF token and other actual async call? Is their a way to make XSRF token to use it per browser session?. The reason why I asking is this, ours is already a fully coded application, and if former is the case, I have to edit each and every async call and make it XSRF secure and not to mention, performance will be a issue as I have to make 2 async calls everytime.

Answer 1

There is only one Async call - not two. Your client only needs to get a token once, and then you simply tell your service to include this token with each subsequent RPC call.
I actually add this token to the host page using JSP - set it as a JavaScript variable and then access it from my code.