Some technical specs on the token: when used, it creates 2 hidden fields on the form: a field called
struts.token.name containing the name of the token, and a field with the name of the token and a randomly generated token. This token is also saved in the session, and the name of the token is stated in the configuration page. We configure each page token to have a unique name based on the name of the page and the ID of the token, if available. This is so a user can have 2 edit pages of the same type open, for example to copy over certain attributes from one object to the next.
When the page is submitted, a check is made whether the page contains a token of the name stated in the configuration page. If not, the page throws an error. If the token is present, a check is made whether the token is the same as the one stored in the session. If not, the page throws an error. If both checks pass, the page proceeds as normal.