Remove csrfToken if disable-xsrf-protection is true (#14111)

If the server sends no token and the client value remains "init" then
it's not sent back to the server.

Change-Id: I74fc470c5c22d57c4a48eab3e4476ae4cc2dd242

2 files changed, 115 insertions, 109 deletions

diff --git a/client/src/com/vaadin/client/ApplicationConnection.java b/client/src/com/vaadin/client/ApplicationConnection.java
index 6bbca98042..6abcdac487 100644
--- a/client/src/com/vaadin/client/ApplicationConnection.java
+++ b/client/src/com/vaadin/client/ApplicationConnection.java
@@ -1,12 +1,12 @@
 /*
  * Copyright 2000-2014 Vaadin Ltd.
- * 
+ *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not
  * use this file except in compliance with the License. You may obtain a copy of
  * the License at
- * 
+ *
  * http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
@@ -111,14 +111,14 @@ import com.vaadin.shared.ui.ui.UIState.PushConfigurationState;
  * This is the client side communication "engine", managing client-server
  * communication with its server side counterpart
  * com.vaadin.server.VaadinService.
- * 
+ *
  * Client-side connectors receive updates from the corresponding server-side
  * connector (typically component) as state updates or RPC calls. The connector
  * has the possibility to communicate back with its server side counter part
  * through RPC calls.
- * 
+ *
  * TODO document better
- * 
+ *
  * Entry point classes (widgetsets) define <code>onModuleLoad()</code>.
  */
 public class ApplicationConnection implements HasHandlers {
@@ -150,12 +150,12 @@ public class ApplicationConnection implements HasHandlers {
      * A string that, if found in a non-JSON response to a UIDL request, will
      * cause the browser to refresh the page. If followed by a colon, optional
      * whitespace, and a URI, causes the browser to synchronously load the URI.
-     * 
+     *
      * <p>
      * This allows, for instance, a servlet filter to redirect the application
      * to a custom login page when the session expires. For example:
      * </p>
-     * 
+     *
      * <pre>
      * if (sessionExpired) {
      *     response.setHeader(&quot;Content-Type&quot;, &quot;text/html&quot;);
@@ -168,7 +168,7 @@ public class ApplicationConnection implements HasHandlers {
     public static final String UIDL_REFRESH_TOKEN = "Vaadin-Refresh";
 
     // will hold the CSRF token once received
-    private String csrfToken = "init";
+    private String csrfToken = ApplicationConstants.CSRF_TOKEN_DEFAULT_VALUE;
 
     private final HashMap<String, String> resourcesMap = new HashMap<String, String>();
 
@@ -346,7 +346,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Event triggered when a XHR request has finished with the status code of
      * the response.
-     * 
+     *
      * Useful for handlers observing network failures like online/off-line
      * monitors.
      */
@@ -402,12 +402,12 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Event triggered when a application is stopped by calling
      * {@link ApplicationConnection#setApplicationRunning(false)}.
-     * 
+     *
      * To listen for the event add a {@link ApplicationStoppedHandler} by
      * invoking
      * {@link ApplicationConnection#addHandler(ApplicationConnection.ApplicationStoppedEvent.Type, ApplicationStoppedHandler)}
      * to the {@link ApplicationConnection}
-     * 
+     *
      * @since 7.1.8
      * @author Vaadin Ltd
      */
@@ -434,7 +434,7 @@ public class ApplicationConnection implements HasHandlers {
         /**
          * Called when a communication error has occurred. Returning
          * <code>true</code> from this method suppresses error handling.
-         * 
+         *
          * @param details
          *            A string describing the error.
          * @param statusCode
@@ -449,7 +449,7 @@ public class ApplicationConnection implements HasHandlers {
      * A listener for listening to application stopped events. The listener can
      * be added to a {@link ApplicationConnection} by invoking
      * {@link ApplicationConnection#addHandler(ApplicationStoppedEvent.Type, ApplicationStoppedHandler)}
-     * 
+     *
      * @since 7.1.8
      * @author Vaadin Ltd
      */
@@ -459,7 +459,7 @@ public class ApplicationConnection implements HasHandlers {
          * Triggered when the {@link ApplicationConnection} marks a previously
          * running application as stopped by invoking
          * {@link ApplicationConnection#setApplicationRunning(false)}
-         * 
+         *
          * @param event
          *            the event triggered by the {@link ApplicationConnection}
          */
@@ -570,7 +570,7 @@ public class ApplicationConnection implements HasHandlers {
      * called once this application has started (first response received) or
      * failed to start. This ensures that the applications are started in order,
      * to avoid session-id problems.
-     * 
+     *
      */
     public void start() {
         String jsonText = configuration.getUIDL();
@@ -671,7 +671,7 @@ public class ApplicationConnection implements HasHandlers {
      * <li><code>vaadin.postRequestHooks</code> is a map of functions which gets
      * called after each XHR made by vaadin application. Note, that it is
      * attaching js functions responsibility to create the variable like this:
-     * 
+     *
      * <code><pre>
      * if(!vaadin.postRequestHooks) {vaadin.postRequestHooks = new Object();}
      * postRequestHooks.myHook = function(appId) {
@@ -682,7 +682,7 @@ public class ApplicationConnection implements HasHandlers {
      * </pre></code> First parameter passed to these functions is the identifier
      * of Vaadin application that made the request.
      * </ul>
-     * 
+     *
      * TODO make this multi-app aware
      */
     private native void initializeClientHooks()
@@ -713,7 +713,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Runs possibly registered client side post request hooks. This is expected
      * to be run after each uidl request made by Vaadin application.
-     * 
+     *
      * @param appId
      */
     private static native void runPostRequestHooks(String appId)
@@ -733,7 +733,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * If on Liferay and logged in, ask the client side session management
      * JavaScript to extend the session duration.
-     * 
+     *
      * Otherwise, Liferay client side JavaScript will explicitly expire the
      * session even though the server side considers the session to be active.
      * See ticket #8305 for more information.
@@ -752,7 +752,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Indicates whether or not there are currently active UIDL requests. Used
      * internally to sequence requests properly, seldom needed in Widgets.
-     * 
+     *
      * @return true if there are active requests
      */
     public boolean hasActiveRequest() {
@@ -772,7 +772,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Requests an analyze of layouts, to find inconsistencies. Exclusively used
      * for debugging during development.
-     * 
+     *
      * @deprecated as of 7.1. Replaced by {@link UIConnector#analyzeLayouts()}
      */
     @Deprecated
@@ -784,7 +784,7 @@ public class ApplicationConnection implements HasHandlers {
      * Sends a request to the server to print details to console that will help
      * the developer to locate the corresponding server-side connector in the
      * source code.
-     * 
+     *
      * @param serverConnector
      * @deprecated as of 7.1. Replaced by
      *             {@link UIConnector#showServerDebugInfo(ServerConnector)}
@@ -796,7 +796,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Makes an UIDL request to the server.
-     * 
+     *
      * @param reqInvocations
      *            Data containing RPC invocations and all related information.
      * @param extraParams
@@ -810,8 +810,10 @@ public class ApplicationConnection implements HasHandlers {
         startRequest();
 
         JSONObject payload = new JSONObject();
-        payload.put(ApplicationConstants.CSRF_TOKEN, new JSONString(
-                getCsrfToken()));
+        if (!getCsrfToken().equals(ApplicationConstants.CSRF_TOKEN_DEFAULT_VALUE)) {
+            payload.put(ApplicationConstants.CSRF_TOKEN, new JSONString(
+                    getCsrfToken()));
+        }
         payload.put(ApplicationConstants.RPC_INVOCATIONS, reqInvocations);
         payload.put(ApplicationConstants.SERVER_SYNC_ID, new JSONNumber(
                 lastSeenServerSyncId));
@@ -833,7 +835,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Sends an asynchronous or synchronous UIDL request to the server using the
      * given URI.
-     * 
+     *
      * @param uri
      *            The URI to use for the request. May includes GET parameters
      * @param payload
@@ -971,7 +973,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Handles received UIDL JSON text, parsing it, and passing it on to the
      * appropriate handlers, while logging timing information.
-     * 
+     *
      * @param jsonText
      * @param statusCode
      */
@@ -999,7 +1001,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Sends an asynchronous UIDL request to the server using the given URI.
-     * 
+     *
      * @param uri
      *            The URI to use for the request. May includes GET parameters
      * @param payload
@@ -1134,7 +1136,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Checks whether or not the CSS is loaded. By default checks the size of
      * the loading indicator element.
-     * 
+     *
      * @return
      */
     protected boolean isCSSLoaded() {
@@ -1144,12 +1146,12 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Shows the communication error notification.
-     * 
+     *
      * @param details
      *            Optional details for debugging.
      * @param statusCode
      *            The status code returned for the request
-     * 
+     *
      */
     protected void showCommunicationError(String details, int statusCode) {
         VConsole.error("Communication error: " + details);
@@ -1158,7 +1160,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Shows the authentication error notification.
-     * 
+     *
      * @param details
      *            Optional details for debugging.
      */
@@ -1169,7 +1171,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Shows the session expiration notification.
-     * 
+     *
      * @param details
      *            Optional details for debugging.
      */
@@ -1180,7 +1182,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Shows an error notification.
-     * 
+     *
      * @param details
      *            Optional details for debugging.
      * @param message
@@ -1193,7 +1195,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Shows the error notification.
-     * 
+     *
      * @param details
      *            Optional details for debugging.
      */
@@ -1281,7 +1283,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * This method is called after applying uidl change set to application.
-     * 
+     *
      * It will clean current and queued variable change sets. And send next
      * change set if it exists.
      */
@@ -1300,7 +1302,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Cleans given queue of variable changes of such changes that came from
      * components that do not exist anymore.
-     * 
+     *
      * @param variableBurst
      */
     private void cleanVariableBurst(
@@ -1325,7 +1327,7 @@ public class ApplicationConnection implements HasHandlers {
      * <p>
      * Used by the native "client.isActive" function.
      * </p>
-     * 
+     *
      * @return true if deferred commands are (potentially) being executed, false
      *         otherwise
      */
@@ -1340,7 +1342,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Returns the loading indicator used by this ApplicationConnection
-     * 
+     *
      * @return The loading indicator for this ApplicationConnection
      */
     public VLoadingIndicator getLoadingIndicator() {
@@ -1349,7 +1351,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Determines whether or not the loading indicator is showing.
-     * 
+     *
      * @return true if the loading indicator is visible
      * @deprecated As of 7.1. Use {@link #getLoadingIndicator()} and
      *             {@link VLoadingIndicator#isVisible()}.isVisible() instead.
@@ -1383,7 +1385,7 @@ public class ApplicationConnection implements HasHandlers {
      * server is received.
      * <p>
      * The initial id when no request has yet been processed is -1.
-     * 
+     *
      * @return and id identifying the response
      */
     public int getLastResponseId() {
@@ -1806,13 +1808,13 @@ public class ApplicationConnection implements HasHandlers {
             /**
              * Sends the state change events created while updating the state
              * information.
-             * 
+             *
              * This must be called after hierarchy change listeners have been
              * called. At least caption updates for the parent are strange if
              * fired from state change listeners and thus calls the parent
              * BEFORE the parent is aware of the child (through a
              * ConnectorHierarchyChangedEvent)
-             * 
+             *
              * @param pendingStateChangeEvents
              *            The events to send
              */
@@ -2127,7 +2129,7 @@ public class ApplicationConnection implements HasHandlers {
              * Updates the connector hierarchy and returns a list of events that
              * should be fired after update of the hierarchy and the state is
              * done.
-             * 
+             *
              * @param json
              *            The JSON containing the hierarchy information
              * @return A collection of events that should be fired when update
@@ -2524,9 +2526,9 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Adds an explicit RPC method invocation to the send queue.
-     * 
+     *
      * @since 7.0
-     * 
+     *
      * @param invocation
      *            RPC method invocation
      * @param delayed
@@ -2566,7 +2568,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Removes any pending invocation of the given method from the queue
-     * 
+     *
      * @param invocation
      *            The invocation to remove
      */
@@ -2584,12 +2586,12 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * This method sends currently queued variable changes to server. It is
      * called when immediate variable update must happen.
-     * 
+     *
      * To ensure correct order for variable changes (due servers multithreading
      * or network), we always wait for active request to be handler before
      * sending a new one. If there is an active request, we will put varible
      * "burst" to queue that will be purged after current request is handled.
-     * 
+     *
      */
     public void sendPendingVariableChanges() {
         if (!deferedSendPending) {
@@ -2630,11 +2632,11 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Build the variable burst and send it to server.
-     * 
+     *
      * When sync is forced, we also force sending of all pending variable-bursts
      * at the same time. This is ok as we can assume that DOM will never be
      * updated after this.
-     * 
+     *
      * @param pendingInvocations
      *            List of RPC method invocations to send
      */
@@ -2721,7 +2723,7 @@ public class ApplicationConnection implements HasHandlers {
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update.
      * </p>
-     * 
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2743,7 +2745,7 @@ public class ApplicationConnection implements HasHandlers {
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update.
      * </p>
-     * 
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2766,7 +2768,7 @@ public class ApplicationConnection implements HasHandlers {
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update.
      * </p>
-     * 
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2789,7 +2791,7 @@ public class ApplicationConnection implements HasHandlers {
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update.
      * </p>
-     * 
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2812,7 +2814,7 @@ public class ApplicationConnection implements HasHandlers {
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update.
      * </p>
-     * 
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2835,7 +2837,7 @@ public class ApplicationConnection implements HasHandlers {
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update.
      * </p>
-     * 
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2858,7 +2860,7 @@ public class ApplicationConnection implements HasHandlers {
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update.
      * </p>
-     * 
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2881,7 +2883,7 @@ public class ApplicationConnection implements HasHandlers {
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update.
      * </p>
-     * 
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2898,13 +2900,13 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Sends a new value for the given paintables given variable to the server.
-     * 
+     *
      * The update is actually queued to be sent at a suitable time. If immediate
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update.
-     * 
+     *
      * A null array is sent as an empty array.
-     * 
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2921,14 +2923,14 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Sends a new value for the given paintables given variable to the server.
-     * 
+     *
      * The update is actually queued to be sent at a suitable time. If immediate
      * is true, the update is sent as soon as possible. If immediate is false,
      * the update will be sent along with the next immediate update. </p>
-     * 
+     *
      * A null array is sent as an empty array.
-     * 
-     * 
+     *
+     *
      * @param paintableId
      *            the id of the paintable that owns the variable
      * @param variableName
@@ -2945,7 +2947,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Does absolutely nothing. Replaced by {@link LayoutManager}.
-     * 
+     *
      * @param container
      * @deprecated As of 7.0, serves no purpose
      */
@@ -2967,7 +2969,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Returns false
-     * 
+     *
      * @param paintable
      * @return false, always
      * @deprecated As of 7.0, serves no purpose
@@ -2979,7 +2981,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Returns false
-     * 
+     *
      * @param paintable
      * @return false, always
      * @deprecated As of 7.0, serves no purpose
@@ -3000,16 +3002,16 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Get either an existing ComponentConnector or create a new
      * ComponentConnector with the given type and id.
-     * 
+     *
      * If a ComponentConnector with the given id already exists, returns it.
      * Otherwise creates and registers a new ComponentConnector of the given
      * type.
-     * 
+     *
      * @param connectorId
      *            Id of the paintable
      * @param connectorType
      *            Type of the connector, as passed from the server side
-     * 
+     *
      * @return Either an existing ComponentConnector or a new ComponentConnector
      *         of the given type
      */
@@ -3022,15 +3024,15 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Creates a new ServerConnector with the given type and id.
-     * 
+     *
      * Creates and registers a new ServerConnector of the given type. Should
      * never be called with the connector id of an existing connector.
-     * 
+     *
      * @param connectorId
      *            Id of the new connector
      * @param connectorType
      *            Type of the connector, as passed from the server side
-     * 
+     *
      * @return A new ServerConnector of the given type
      */
     private ServerConnector createAndRegisterConnector(String connectorId,
@@ -3050,7 +3052,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Gets a recource that has been pre-loaded via UIDL, such as custom
      * layouts.
-     * 
+     *
      * @param name
      *            identifier of the resource to get
      * @return the resource
@@ -3061,7 +3063,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Singleton method to get instance of app's context menu.
-     * 
+     *
      * @return VContextMenu object
      */
     public VContextMenu getContextMenu() {
@@ -3076,7 +3078,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Gets an {@link Icon} instance corresponding to a URI.
-     * 
+     *
      * @since 7.2
      * @param uri
      * @return Icon object
@@ -3098,7 +3100,7 @@ public class ApplicationConnection implements HasHandlers {
      * Translates custom protocols in UIDL URI's to be recognizable by browser.
      * All uri's from UIDL should be routed via this method before giving them
      * to browser due URI's in UIDL may contain custom protocols like theme://.
-     * 
+     *
      * @param uidlUri
      *            Vaadin URI from uidl
      * @return translated URI ready for browser
@@ -3170,7 +3172,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Gets the URI for the current theme. Can be used to reference theme
      * resources.
-     * 
+     *
      * @return URI to the current theme
      */
     public String getThemeUri() {
@@ -3180,7 +3182,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Listens for Notification hide event, and redirects. Used for system
      * messages, such as session expired.
-     * 
+     *
      */
     private class NotificationRedirect implements VNotification.EventListener {
         String url;
@@ -3209,7 +3211,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Gets the token (aka double submit cookie) that the server uses to protect
      * against Cross Site Request Forgery attacks.
-     * 
+     *
      * @return the CSRF token string
      */
     public String getCsrfToken() {
@@ -3219,7 +3221,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Use to notify that the given component's caption has changed; layouts may
      * have to be recalculated.
-     * 
+     *
      * @param component
      *            the Paintable whose caption has changed
      * @deprecated As of 7.0.2, has not had any effect for a long time
@@ -3231,7 +3233,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Gets the main view
-     * 
+     *
      * @return the main view
      */
     public UIConnector getUIConnector() {
@@ -3240,7 +3242,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Gets the {@link ApplicationConfiguration} for the current application.
-     * 
+     *
      * @see ApplicationConfiguration
      * @return the configuration for this application
      */
@@ -3253,7 +3255,7 @@ public class ApplicationConnection implements HasHandlers {
      * list of events which has server side listeners is updated automatically
      * before the component is updated so the value is correct if called from
      * updatedFromUIDL.
-     * 
+     *
      * @param paintable
      *            The connector to register event listeners for
      * @param eventIdentifier
@@ -3273,7 +3275,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Adds the get parameters to the uri and returns the new uri that contains
      * the parameters.
-     * 
+     *
      * @param uri
      *            The uri to which the parameters should be added.
      * @param extraParams
@@ -3326,7 +3328,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Get VTooltip instance related to application connection
-     * 
+     *
      * @return VTooltip instance
      */
     public VTooltip getVTooltip() {
@@ -3338,7 +3340,7 @@ public class ApplicationConnection implements HasHandlers {
      * this method is now handled by the state change event handler in
      * AbstractComponentConnector. The only function this method has is to
      * return true if the UIDL is a "cached" update.
-     * 
+     *
      * @param component
      * @param uidl
      * @param manageCaption
@@ -3389,7 +3391,7 @@ public class ApplicationConnection implements HasHandlers {
      * Schedules a heartbeat request to occur after the configured heartbeat
      * interval elapses if the interval is a positive number. Otherwise, does
      * nothing.
-     * 
+     *
      * @deprecated as of 7.2, use {@link Heartbeat#schedule()} instead
      */
     @Deprecated
@@ -3403,7 +3405,7 @@ public class ApplicationConnection implements HasHandlers {
      * Heartbeat requests are used to inform the server that the client-side is
      * still alive. If the client page is closed or the connection lost, the
      * server will eventually close the inactive UI.
-     * 
+     *
      * @deprecated as of 7.2, use {@link Heartbeat#send()} instead
      */
     @Deprecated
@@ -3427,7 +3429,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * This method can be used to postpone rendering of a response for a short
      * period of time (e.g. to avoid the rendering process during animation).
-     * 
+     *
      * @param lock
      */
     public void suspendReponseHandling(Object lock) {
@@ -3436,7 +3438,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Resumes the rendering process once all locks have been removed.
-     * 
+     *
      * @param lock
      */
     public void resumeResponseHandling(Object lock) {
@@ -3481,7 +3483,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Sets the delegate that is called whenever a communication error occurrs.
-     * 
+     *
      * @param delegate
      *            the delegate.
      */
@@ -3524,7 +3526,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Gets the active connector for focused element in browser.
-     * 
+     *
      * @return Connector for focused element or null.
      */
     private ComponentConnector getActiveConnector() {
@@ -3538,7 +3540,7 @@ public class ApplicationConnection implements HasHandlers {
 
     /**
      * Sets the status for the push connection.
-     * 
+     *
      * @param enabled
      *            <code>true</code> to enable the push connection;
      *            <code>false</code> to disable the push connection.
@@ -3588,7 +3590,7 @@ public class ApplicationConnection implements HasHandlers {
     /**
      * Returns a human readable string representation of the method used to
      * communicate with the server.
-     * 
+     *
      * @since 7.1
      * @return A string representation of the current transport type
      */
diff --git a/client/src/com/vaadin/client/communication/AtmospherePushConnection.java b/client/src/com/vaadin/client/communication/AtmospherePushConnection.java
index 48e17cde05..5073e0ce5d 100644
--- a/client/src/com/vaadin/client/communication/AtmospherePushConnection.java
+++ b/client/src/com/vaadin/client/communication/AtmospherePushConnection.java
@@ -1,12 +1,12 @@
 /*
  * Copyright 2000-2014 Vaadin Ltd.
- * 
+ *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not
  * use this file except in compliance with the License. You may obtain a copy of
  * the License at
- * 
+ *
  * http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
@@ -37,7 +37,7 @@ import com.vaadin.shared.ui.ui.UIState.PushConfigurationState;
 /**
  * The default {@link PushConnection} implementation that uses Atmosphere for
  * handling the communication channel.
- * 
+ *
  * @author Vaadin Ltd
  * @since 7.1
  */
@@ -171,8 +171,12 @@ public class AtmospherePushConnection implements PushConnection {
                         + ApplicationConstants.PUSH_PATH + '/');
         String extraParams = UIConstants.UI_ID_PARAMETER + "="
                 + connection.getConfiguration().getUIId();
-        extraParams += "&" + ApplicationConstants.CSRF_TOKEN_PARAMETER + "="
-                + connection.getCsrfToken();
+
+        if (!connection.getCsrfToken().equals(
+                ApplicationConstants.CSRF_TOKEN_DEFAULT_VALUE)) {
+            extraParams += "&" + ApplicationConstants.CSRF_TOKEN_PARAMETER
+                    + "=" + connection.getCsrfToken();
+        }
 
         // uri is needed to identify the right connection when closing
         uri = ApplicationConnection.addGetParameters(baseUrl, extraParams);
@@ -239,9 +243,9 @@ public class AtmospherePushConnection implements PushConnection {
     /**
      * Called whenever a server push connection is established (or
      * re-established).
-     * 
+     *
      * @param response
-     * 
+     *
      * @since 7.2
      */
     protected void onConnect(AtmosphereResponse response) {
@@ -330,7 +334,7 @@ public class AtmospherePushConnection implements PushConnection {
     /**
      * Called if the push connection fails. Atmosphere will automatically retry
      * the connection until successful.
-     * 
+     *
      */
     protected void onError(AtmosphereResponse response) {
         state = State.DISCONNECTED;
@@ -448,7 +452,7 @@ public class AtmospherePushConnection implements PushConnection {
             contentType: 'application/json; charset=UTF-8',
             reconnectInterval: 5000,
             timeout: -1,
-            maxReconnectOnClose: 10000000, 
+            maxReconnectOnClose: 10000000,
             trackMessageLength: true,
             enableProtocol: true,
             messageDelimiter: String.fromCharCode(@com.vaadin.shared.communication.PushConstants::MESSAGE_DELIMITER)
@@ -501,7 +505,7 @@ public class AtmospherePushConnection implements PushConnection {
 
     private static native boolean isAtmosphereLoaded()
     /*-{
-        return $wnd.jQueryVaadin != undefined;  
+        return $wnd.jQueryVaadin != undefined;
     }-*/;
 
     private void runWhenAtmosphereLoaded(final Command command) {