A third party security review is suggesting I need to add CSRF prevention to my javascript remoting calls. I'm not sure what is the best way to proceed. Switching to an apex:form to utilize built in CSRF prevention is not an option for me.

I am aware that the element input#com.salesforce.visualforce.ViewStateCSRF contains an anti-CSRF token, but if I pass it into my remoting calls, what would I have to compare it to server-side?

Would it be insecure if I rolled my own anti-CSRF token by generating a random string in my page's constructor and injecting it into my remoting calls?

2 Answers 2


Javascript remoting actually contains system-managed CSRF protection built in. If you actually inspect the data going over the wire for a remoting call you see a "ctx" is passed that contains information like the Id of the visualforce page you're on and a csrf token. The server automatically validates these and remoting calls with invalid tokens are rejected.

I just tested this by corrupting the csrf token on an otherwise valid remoting call and response from the server was:

    "type": "exception",
    "tid": 7,
    "ref": false,
    "action": "MyController",
    "method": "doStuff",
    "message": "Remoting request invalid for your session.  Refresh page and re-submit request",
    "where": "",
    "data": [
    "vfTx": true,
    "vfDbg": true

With that said I don't think there's anything further you need to do in order to have csrf protection.

  • Unfortunately I have figured out how to reproduce the exploit and can successfully perform CSRF attacks against remote actions but i'm not sure it would be correct for me to post the exploit here. Having said that, as you pointed out there is CSRF protection in place it just seems to be bugged so I will log a case with salesforce.
    – Phil Rymek
    Commented May 13, 2013 at 22:33
  • 2
    Do that, and then email the case number to [email protected]. Their security guys are hardcore and will jump on any serious threats. Commented May 14, 2013 at 2:59
  • Strangely I'm encountering this error in my JS Remoting calls, but I'm not even modifying the cix token. Full code details are here - salesforce.stackexchange.com/questions/45819/… ...
    – VarunC
    Commented Aug 2, 2014 at 17:25

I logged a case for this as I was able to perform CSRF hacks against methods annotated with @RemoteAction and the response is:

This is not enabled by default. You have to contact salesforce to get CSRF protection for Remote Actions turned on.

  • 6
    Summer 13 release notes : There are new settings for protection against Cross Site Request Forgery (CSRF) attacks with GET and POST requests. When set, a random string is included as a hidden form in each page or as URL parameters. Then with each request, the application checks the string for validity and doesn’t execute the command if the check fails. From Setup, click Security Controls > Session Settings to select Enable CSRF protection on GET/POST requests on non-setup pages.
    – Doug B
    Commented May 15, 2013 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .