I have a legacy web application and need to protect it from CSRF. I tried to resolve the issue without compromising application functionality, but I got issues related to navigation.
Can generating token and storing them in the form and session prevent the issues related to browsers back button?
Let's say I have submitted the first form in ``test1.jsp and second in test2.jsp. At this point if I try to navigate back using browsers back button and move to test1.jsp and submit the form, it will throw error as the token value from cached page and in session will be different. I tried to prevent cache storage using response headers and load the data from server on back button but the application breaks at this point.My application uses struts framework and I tried to use the struts token method but that didn't help to overcome back button issues.
Is there a way to overcome this browser back button issue using tokens?