The page you submitted was invalid for your session. Please click Save again to confirm your change

Question

I'm getting this error

"The page you submitted was invalid for your session. Please click Save again to confirm your change."

from an inline Visualforce page on page layout.

We have 2 Standard Objects in which we've added inline Visualforce pages for our support personel to verifiy a customers pin. The PIN is stored encrypted on the Contact sObject. The VF page and accompanying custom controller accepts input from our support personel, encrypts the input and checks to see if it matches what we have on record and displays an appropriate message.

I've been tasked with adding this functionality to another custom object (a child of Contact). When I access the VF page directly I get no errors, but when I try to use it inline in the page layout I get this error.

I've also noticed that the previously built functionality is also giving this error in our. The odd thing is that this error is only happening in our sandbox (CS19) right now. In production (NA28) the previous functionality is still working fine.

I'm not doing any URL hacking, or page redirecting. I'm simpy rerendering the VF page.

<apex:form id="securityForm" >
    <div class="{!IF(hasPIN,'slds-show','slds-hide')}">
        <div class="{!IF(NOT(PINMatches),'slds-show','slds-hide')} input-wrapper">
            <div class="slds-form-element {!IF(AND(NOT(PINInput == ''), NOT(PINMatches)),'slds-has-error','')}">
                <label class="slds-form-element__label slds-form-element__label--small" for="{!$Component.pinInput}">Enter PIN supplied by Client</label>
            <div class="slds-form-element__control">
                <apex:inputText id="pinInput" styleClass="slds-input slds-input--small" value="{!PINInput}" onkeypress="return noenter(event);" />
                <span id="pinError" class="slds-form-element__help {!IF(AND(NOT(PINInput == ''), NOT(PINMatches)),'slds-visible','slds-hidden')}">Incorrect PIN</span>
            </div>
            </div>
            <apex:commandButton value="Submit" action="{!checkPIN}" rerender="securityForm" styleClass="slds-button slds-button--neutral slds-m-left--small"/>
        </div>

        <div class="{!IF(PINMatches,'slds-show','slds-hide')}">
            Security Information has been verified
        </div>
    </div>
</apex:form>

Method

public void checkPin()
{
    if(PINInput != null)
    {
        Blob inputBlob = Blob.valueOf(PINInput);
        Blob inputHash = Crypto.generateDigest('SHA1', inputBlob);
        String result = EncodingUtil.base64encode(inputHash);
        PINMatches = PINRef.equals(result);
    }
}

Answer 1

Ok, so I logged in today and I'm not getting this error. I don't know why I was getting it earlier or why it's working now.

EDIT:

I figured out why I was getting the error. In the Orgs Security Controls > Session Settings we had enabled the Clickjack protection for VF Pages.

Enable clickjack protection for customer Visualforce pages with standard headers
Enable clickjack protection for customer Visualforce pages with headers disabled 

I was able to resolve the issue by adding the showHeader attribute to the <apex:page /> tag