papegaaij commented on a change in pull request #439: URL: https://github.com/apache/wicket/pull/439#discussion_r462179331
########## File path: wicket-core/src/main/java/org/apache/wicket/protocol/http/CsrfPreventionRequestCycleListener.java ########## @@ -400,7 +454,8 @@ protected String getSourceUri(HttpServletRequest containerRequest) * @param page * the page that is the target of the request */ - protected void checkRequest(HttpServletRequest request, String sourceUri, IRequestablePage page) + protected void checkRequestOriginReferer(HttpServletRequest request, String sourceUri, + IRequestablePage page) Review comment: The change in method name is an API break. This would delay this feature to Wicket 10. To preserve the API, you can create a new method with the old signature to containing the if-block that's now in onRequestHandlerResolved. You will miss the cycle parameter, but that's not a big problem because you can get it via `RequestCycle.get()` ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org