hi

We have a web site developed completely in spring mvc(some 100 jsp pages). we need to address session hijacking by cookie stealing.. we are thinking of the below approach:

In each of the form tag we want to write a hidden form text with a random name and random value to it. The session remembers this data and would allow the page submit iff and only if it has this random name with random value.

Now this is the approach i m thinking of: If i can somehow intercept the html spring form and write an extra html hidden field to it? Any workarounds to this? the main aim is to leave the existing jsp un touched to the extent possible.