Implement anti-CSRF tokens

Hi Everyone,

We are performing security testing in our newly upgraded Siebel 19.7 environment on Azure.

During the testing of the applications forms, It was observed that the application does not provide anti-CSRF tokens.

The remediation is as follows:

• The application should implement anti-CSRF tokens into all requests that perform actions which change the application state or which add/modify/delete content.
• An anti-CSRF token should be a long randomly generated value unique to each user so that attackers cannot easily brute-force it.
• It is important that anti-CSRF tokens are validated when user requests are handled by the application.
• The application should both verify that the token exists in the request, and also check that it matches the user's current token.