I am pentesting Oracle ADF web application. One of the requests to delete some content consists of parameters like
javax.faces.ViewState, which seem to be random numbers, active only during one session.
I'm not sure if this prevents form CSRF attacks? I found some resources like for example this, which suggest adding aditional anti-CSRF token.