An IBM Rational AppScan against a WSS 3.0 installation indicates that it has detected a cross-site request forgery (CSRF/XSRF) vulnerabilities on many pages, for example _layouts/AddContentTypeToList.aspx, _layouts/ManageFeatures.aspx, and _layouts/RecycleBin.aspx. I am trying to determine if these are somehow false positives. Unfortunately, AppScan is not very verbose about how it performs this test.
Searching on the internet, I see lots of pages that mention SPUtility.ValidateFormRequest(), which apparently verifies a token found in a hidden "canary" __REQUESTDIGEST field, which can be created with a SharePoint:FormDigest tag in an application page. This guidance seems to always be presented in very vague terms. For example, this page http://acveer.wordpress.com/2011/06/22/prevent-csrf-cross-site-request-forgery-attacks-in-sharepoint-application-pages/ says that you should "use SharePoint FormDigest Control" to "prevent CSRF attacks in SharePoint application pages." Does that mean I need to do this only in custom application pages, or do I need to modify the out-of-the box page layouts or master pages in order to get this protection? I think the canary value is already present on every page, so does SharePoint check it automatically, and if so, why does AppScan indicate that CSRF is present?