All pages vulnerable to CSRF about grails-spring-security-ui HOT 3 CLOSED

Code has been reviewed and manually squashed/merged into master by @sdelamo

from grails-spring-security-ui.

I posted a suggestion of how to fix this here:
github.com//pull/20

Burt you should fix this before your Securing Grails Applications talk at Springone 2GX, if it's with my pull request, or some variation there of, or I might just have to go to that talk and heckle you(joking obviously).
http://www.springone2gx.com/conference/santa_clara/2013/09/session?id=29370

I'll also post this on the jira page because I don't think you see these comments as often.

from grails-spring-security-ui.

As of May 2016, I confirmed that the latest grails 2.x version is still wide open to this attack on all provided forms.

Looks like users should override every s2ui form they intend to use and manually apply the CSRF protection described by jdega33. More details from grails guides below:

http://docs.grails.org/2.5.x/guide/security.html#securingAgainstAttacks
http://docs.grails.org/2.5.x/guide/single.html#formtokens
and
http://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html

from grails-spring-security-ui.