Preventing cross-site request forgery (CSRF)

Cross-site request forgery (CSRF) is a type of exploit of your web site whereby a malicious party may be able to perform operations posing as a given user of your site, without that user having authorized those operations, or even being aware they are performed.

You can protect your web application against CSRF attacks by generating for each user connecting to the site a random token, and requiring that token to be sent along every request. Software packages, such as Spring Security or OWASP CSRFGuard, can make it easier for you to do this in your own web application.

Orbeon Forms does everything required to prevent CSRF attacks, out-of-the-box, so this is one less thing you'll need to worry about.