Question: I have a service with a content observer watching the calendar provider and there are some instances where i need to stop the service so the observer's `onchange` does not get called when adding an event and then restart the service when it is added.

In my activity I use `stopService(new Intent(context,Service.class));` to stop the service then I start it up again later on trying to avoid the onchange call when the provider gets changed but it does not appear the service gets stopped because the onchange still gets called causing force closes in my database because my query in my service cant find the event yet.

so how can i get around this problem?

Answer: 
There is no way to prevent request forgery while under a clickjacking attack. No CSRF defense exists that can withstand a clickjacking attack, because there is no way to distinguish a real click from a fake click on the client side.

OWASP [mentions in their CRSF prevention spreadsheet](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#No_Cross-Site_Scripting_.28XSS.29_Vulnerabilities) that one of the preconditions for the CSRF token defense to work is that no XSS attack is underway.

In my view this should also include clickjacking, as the CSRF token even hidden inside iframe cannot defend against clickjacking. The request is being forged by a direct user click.

So in the end we are not really stuck between CSRF and Clickjacking - CSRF defenses are meant for a different type of attacks where there is a lot less power on the side of the attacker.

So towards the questions you mention concerning clickjacking and CSRF:

* *What is the best solution (if any) to this problem?* - The best defense for clickjacking on the client side is to open a new browser tab or a resized browser window with a page from your site and confirm the action there, as @Zack mentions. This is what the twitter button does, and there cannot be request forgery in this scenario either.
* *So there is a duality, it seems you are stuck between CSRF and Clickjacking* - The CSRF defenses are not meant for cases like XSS or clickjacking attacks, they are effective only against less powerful attacks (email with malicious link, post malicious link in forum etc.)
**--UPDATE--**
When you say "widget", if you mean something outside of your application that un-authenticated people interact with then disregard this answer. I reread your question and you never really state what you mean by "widget". We have all kinds of "widgets" that are with in our application. I thought that's what you were talking about, everything inside an application that only authenticated users were interacting with. If that is the case then this answer is what OWASP recommends.

**--Original Answer--**
"You don't want this request to be vulnerable to CSRF so you write an iframe to the page." No, don't make an iframe, that way you can do the normal OWASP recommendation for protecting against Cross Site framing.

To protect against CSRF hash some value(s), include it in your form (or ajax POST data), then check the hash value on the back end. If it matches it's from your site. The more specific data you can put in the hash the better.

Example: When a user signs in you can create a long random string and tie that to their session. This string must never be visible on your site or when viewing the source. Then lets say the user pulls up some specific record that they want to edit. You could then take that users long random string you created, append that records primary key to it, then hash them. The result of that hash you can include in your form as a hidden. Then on your backend before you do anything you check for the presence of that hidden, if it doesn't exist, abort. If it does exist, take that users random session string and the clear text primary key they submitted, hash them, if it matches you know it's from your site.

And it's easy to add this everywhere even if your site is already written (assuming your site has some single piece of code included on all pages, like a footer). Make the hashed value and place it in a hidden div somewhere in your footer. Then you can use jQuery to dynamically add this hash value hidden to all forms on the page. And you can use jQuery.ajaxPrefilter to add it to all ajax POSTs automatically in case you are doing a ajax post and not a normal form post. We've protects some very large sites that were already coded this way.

<https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet>

If this sounds like that path you want to take I could show some of the jQuery code for doing it. As far as what your are hashing, how you want to check it on the backend, etc... that all depends on if you are using ColdFusion, PHP, PL/SQL (psp) etc... I can point you in the right direction if its one of those.