I'm unclear as to what this critical update changes for our Org in particular.

Allow CSRF Protection on GET Requests to Visualforce Pages

In our org, we already have the ability to require CSRF on GET requests on Visualforce pages, as seen in the below screen grab:

enter image description here

I've been able to switch this option on and off prior prior to the critical update being available and have seen the CSRF errors when the option is switched on.

We've not activated the critical update at any point (I've checked the history to confirm) and the critical update doesn't seem to automatically switch on this requirement on VF pages in our org, so I'm unclear as to what the actual impact will be from the point of activating this critical update.

Does this critical update only impact certain orgs which didn't have this ability previously?

1 Answer 1


The critical update which will be auto activated from June 11,2017 will allow system admins to check the checkbox "Require CSRF protection on GET requests".

Why would system administrators enabled the checkbox "Require CSRF protection on GET requests" ?

Security is why an admin will be tempted to enable these .This will ensure that when a page is requested via a link like using an anchor tag like below salesforce does not allow these going forward as an attacker might easily redirect to some other page and since the session is active might get creative with sessionIds

<a href="/apex/page1">

What will this change break ?

If your developer has written code that uses below formats

 <a href="/apex/page1">

or using an apex method for URL generation

public String getPage(){
   return '/apex/PageName'; 

The Fixes required prior to your admin enabling "Require CSRF protection on GET requests"?

First and foremost enable the critical update in your sandbox or a Developer edition org and You will go to your Visualforce pages enable the checkboxes and Test .If the VF redirection logic is broken then look for places where you have used anchor tags and replace with one of the below formats

<apex:outputLink value="/apex/PageName">Link using apex:outputlink</apex:outputlink>

<a href="{!$Page.PageName}">Link using $Page</a>

<a href="{!URLFOR($Page.PageName)}">Link using URLFOR()</a>

Similarly ensure all redirection happen via pagereference methods like below

public class customController {
  public PageReference getPage() {
    return new PageReference('/apex/PageName'); 

 public PageReference getPage1() {
  return Page.PageName; 
  • Thank you for your reply. However, as stated in my original question, we are already able to tick that option without the Critical Update activated. Therefore, I am unsure what impact it actually has.
    – Bigears
    Feb 21, 2017 at 13:13
  • Bigears I guess for not all use cases the token was added by the platform .However with critical updates seems like all the use cases for GET requests will be covered .Also the server side using of string did not matter i guess even with that checkbox updates .Looks like from now on all the use cases documented are strictly enforced Feb 21, 2017 at 13:44
  • 1
    Hey @Mohit, And this update is only applicable for Pages whch has CSRF on get requests enabled. if Page1 has it enabled, page 2 did not, any links to page1 from page2 using the format <a href="/apex/page1" /> will break. On the contrary, links from Page1 to Page2 will not have any impacts.
    – kso
    Mar 9, 2017 at 16:38
  • So if my org has none of the pages with the protection enabled, I will not have to do any changes immediatyely, and only if I chose to protect my page with the CSDF setting, i can have to analyse the links wherever this page is called.
    – kso
    Mar 9, 2017 at 16:40
  • 3
    CAUTION: Enabling this update will break any PageReferences with an anchor (meaning a #anchor-content in the URL, not an a tag). We have code that returns a PageReference that has setAnchor called on it, but setAnchor doesn't change the resulting URL with this update enabled. Tier 3 Salesforce support has advised us to disable the update for now, but we still don't know about long term guidance or direction here.
    – jon_wu
    Mar 13, 2017 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.