Provide a better solution for looking up page tokens in the JS logic

[forgedhallpass]

1. The solution differentiates resource URIs if they have a leading forward slash (/)

   This behavior leads to token mismatch exceptions, because the same resource can have two different tokens assigned.
   The resource URIs should be handled in a unified manner for HTTP requests, protected and unprotected page configuration properties by adding a leading forward slash (/) to each of them.

2. If the resource contains URL parameters, the JS logic is not able to associate the appropriate page token

   The parameters should be stripped when looking up the page token value

3. In some cases an existing JS library has already extended the XHR functionalities and when doing a request and when opening an AJAX connection it only provides the name of the resource/endpoint without the full path.

   e.g. endpoint instead of service/endpoint

   The JS logic could be enhanced to try to cater for these situations by computing the full path of the resource and looking up page tokens for it if the previous attempt fails

[forgedhallpass]

Fixed by:

• OWASP/www-project-csrfguard@bea3ae4
• OWASP/www-project-csrfguard@64a2b51