I am getting these from URL..when i submitted my app for security review. their report has XSRF error

can some help me how to correct this...as i need to oid from the url.i could find any alternate solution.i am getting the parameters from force.com site... can some one suggest me the solution...

Map<String,String> parameters=ApexPages.currentPage().getParameters();
orgId = parameters.get('oid');
Call_Back__c obj = new Call_Back__c(Code__c=code,Customer_Org_Id__c=orgId);
upsert obj Customer_Org_Id__c;

2 Answers 2


First, I'd highly recommend taking advantage of the security team's office hours. They are extremely helpful and also respond to emails with questions in a quick manner.

Couple general ways to deal with XSRF, from easiest to hardest:

  • change your page to only take the action after the user clicks on a confirmation-style CommandButton or similar. This goes through the VF native anti-XSRF stuff, and is the easiest solution, but it isn't always appropriate.
  • use the SFDC-native, XSRF-resistant stuff like JavaScript remoting or Apex REST.
  • manage your own XSRF token. You can do something like generate a long random string and store it in a user-specific custom setting along with a (brief) expiration period. Your page first checks the token against what it expected, and doesn't allow the action to occur if the token doesn't match.

This looks like a Checkmarx result false positive. If so, please send an email to sourcescanner@salesforce.com explaining the issue.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.