title: Struts2 token interceptor: CSRF protection
body: <p>I am trying to protect my web application from CSRF attacks by using struts token interceptor.</p>
  
  <p>The problem I am facing right now is our JSP pages makes more than one call to server (While JSP is converted to JS a struts token is added to JS.But in this JS there are multiple Ajax request. I hope I am making myself clear.), because of token interceptor only first request to the server is getting validated. Other requests are getting invalidated because struts token is reset after each validation.</p>
  
  <p>Is there a way I stop Struts from resetting the token every time it validates? 
  IS there any other solutions to handle this in struts interceptor.</p>
  
  <p>I am also looking at <code>tomcatcsrfprotection</code> module, I guess I will end up with same problem here also.</p>
  
  <p><strong><code>managepage.jsp</code>:</strong></p>
  
  <pre><code>&lt;s:token /&gt;
  &lt;script type="text/javascript"&gt;
  var strutsToken = "&lt;s:property value="#session['struts.tokens.token']" /&gt;";
  var requestParams = {mainAction: 'loadGroups','struts.token.name': 'token' , token:strutsToken};
  
  Ext.Ajax.request({
                url: 'manageUserAccount.action',
                params: Ext.urlEncode(requestParams),
                disableCaching: true,
                success: this.actionCallback
                });
  
  
  
  //loading widgets
  
  var requestParams = {mainAction: 'loadusers','struts.token.name': 'token' , token:strutsToken};
  
  Ext.Ajax.request({
                url: 'manageUserAccount.action',
                params: Ext.urlEncode(requestParams),
                disableCaching: true,
                success: this.actionCallback
                });
  
  &lt;/script&gt;
  </code></pre>
  
  <hr>
  
  <p><strong><code>Struts.xml</code>:</strong></p>
  
  <pre><code>  &lt;action name="manageUserAccountEdit" class="ManageUserAccountEditAction"&gt;
       &lt;interceptor-ref name="csrf-protection" /&gt; 
       &lt;result name="success"&gt;/pages/manageUserAccount.jsp&lt;/result&gt;
   &lt;/action&gt;
  </code></pre>
  
  <p>I have just added minimum code so that understanding it will be easier.</p>