Lightning security on init page load with server-side call

Question

I was reading through the Lightning Security documentation here and noticed one of the points for Cross Site Forgery.

In order to prevent CSRF attacks, do not invoke any server-side controller method that performs a DML operation automatically as the result of a page load. Specifically, do not invoke server-side DML controller method as onInit handlers, or afterRender handlers (if rendering is performed automatically on page load).

The key is that the DML operation not be performed without an event stemming from human interaction, such as a click. CSRF only applies to server-side DML operations, not operations that update client-side component attributes.

What if I do need to do need to invoke some server side method on the onInit handler? Currently, I have something like below:

<aura:handler name="init" value="{!this}" action="{!c.initializeComponent}"/>

({
    initializeComponent: function(component, event, helper) {
        // api request to my external endpoint
        var action = component.get("v.imageApi");
        
        action.setCallback(this, function(response){
           var images = JSON.parse(response.getReturnValue());
           component.set("v.images", images);
        });

        $A.enqueueAction(action, true);
})

Would it be more secure if I moved this over to a helper method instead?

Answer 1

If your component's init action invokes an server-side method which queries(i.e Read) records, then you are fine.

For example :

<aura:handler name="init" value="{!this}" action="{!c.initializeComponent}"/>

Controller.js

({
    initializeComponent: function(component, event, helper) {
        // api request to my external endpoint
        var action = component.get("c.getContacts");

        action.setCallback(this, function(response){
           var images = JSON.parse(response.getReturnValue());
           component.set("v.images", images);
        });

        $A.enqueueAction(action, true);
})

Apex Controller :

public class LightningCtrl {

   // we are good here
   @AuraEnabled
   public static List<Contact> getCotacts(){
        return [SELECT id,Name FROM Contact]; 
   }
}

But if the server-side method invoked during init/afterRender, does an Create/Update/Delete then, you are vulnerable to CSRF attacks.That is what the below line states:

In order to prevent CSRF attacks, do not invoke any server-side controller method that performs a DML operation automatically as the result of a page load. Specifically, do not invoke server-side DML controller method as onInit handlers, or afterRender handlers (if rendering is performed automatically on page load).

For example :

public class LightningCtrl {

       @AuraEnabled
       public static List<Contact> getCotacts(){
            App_Visit__c visit = [SELECT Id,Count__c FROM App_Visit__c WHERE Name = 'TestApp'];

            if(visit.isEmpty()){
                visit = new App_Visit__c(Name = 'TestApp');
            }

            visit.Count__c += 1;

            upsert visit; // CLEAR NO...NO...
            return [SELECT id,Name FROM Contact];
       }
    }