title: CSRF token in GET method
body: <p>I am going to avoid CSRF atack in my web application.</p>
  
  <p>I've set up csrf configuration on my apache, like this:</p>
  
  <pre><code>&lt;VirtualHost&gt;
  ...
  
      CSRF_Enable on
      CSRF_Action deny
      CSRF_EnableReferer off
  
  
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>Also, I've installed the following apache modules:</p>
  
  <pre><code>mod_csrf-0.3
  mod_parp-0.12
  mod_setenvifplus-0.23
  </code></pre>
  
  <p>that have possibility to ignore CRSF in some cases.</p>
  
  <p>All stuff works fine, namely <strong>csrfpid</strong> add to all POST method and does not add to GET.</p>
  
  <p>But one issue was found. When I try to send GET method with parameter:
  <strong>www.example.com/test.jsp?csrfpid=some_csrf_id&amp;some_attribute=0</strong>,
  <strong>csrfpid</strong> token has attached to link.</p>
  
  <p>I've tried to play with:</p>
  
  <pre><code>SetEnvIfPlus Request_Method "GET" CSRF_IGNORE=yes.
  </code></pre>
  
  <p>But, it does not work in my case. </p>
  
  <p>Also, I've found, that the issue causes through <strong>mod_csrf.c</strong> file.</p>
  
  <p>It will be good to get some ideas or helpful link regarding to the described case.</p>