I was wondering: it now seems to be more and more common to see people/framework putting cryptographic tokens in the URLs their webapps are generating (to prevent quite effectively against quite some attacks). It is advised by OWASP etc.
However I was wondering: what was the earliest known usage of this technique (specifically inside Web URLs)?
I've found a message on Usenet dating from 2003 (for a Java webapp) describing the technique by someone who, obviously, independently discovered it (he's asking for know "prior art"):
Every single link in any of the jsp page transmitted to the client is generated with a checksum that act as a signature for the URL
The description clearly shows it's a cryptographic checksum being used (and the way it works seems very close to the modern "tokens" OWASP advocates etc.).
Interestingly enough the person describing it says that "it cannot hurt" but that it may not be that useful since that Java is relatively immune to buffer overflow. The author couldn't have imagined that this technique would has stopped most XSS and CSRF exploits dead in their track way before these techniques were even invented...
So my question is simple: what are the oldest know usage of this technique you know of?
EDIT Upon re-reading the old description, I think in that message from 2003 the technique is even more advanced than the "per-session tokens" that OWASP advocates in that every single parameters are checked against forgery (but I'm not sure)