Critical Update - Allow CSRF Protection on GET Requests to Visualforce Pages - Confusion as to what is being enabled

Question

I'm unclear as to what this critical update changes for our Org in particular.

Allow CSRF Protection on GET Requests to Visualforce Pages

In our org, we already have the ability to require CSRF on GET requests on Visualforce pages, as seen in the below screen grab:

I've been able to switch this option on and off prior prior to the critical update being available and have seen the CSRF errors when the option is switched on.

We've not activated the critical update at any point (I've checked the history to confirm) and the critical update doesn't seem to automatically switch on this requirement on VF pages in our org, so I'm unclear as to what the actual impact will be from the point of activating this critical update.

Does this critical update only impact certain orgs which didn't have this ability previously?

Answer 1

The critical update which will be auto activated from June 11,2017 will allow system admins to check the checkbox "Require CSRF protection on GET requests".

Why would system administrators enabled the checkbox "Require CSRF protection on GET requests" ?

Security is why an admin will be tempted to enable these .This will ensure that when a page is requested via a link like using an anchor tag like below salesforce does not allow these going forward as an attacker might easily redirect to some other page and since the session is active might get creative with sessionIds

<a href="/apex/page1">

What will this change break ?

If your developer has written code that uses below formats

 <a href="/apex/page1">

or using an apex method for URL generation

public String getPage(){
   return '/apex/PageName'; 
}

The Fixes required prior to your admin enabling "Require CSRF protection on GET requests"?

First and foremost enable the critical update in your sandbox or a Developer edition org and You will go to your Visualforce pages enable the checkboxes and Test .If the VF redirection logic is broken then look for places where you have used anchor tags and replace with one of the below formats

<apex:outputLink value="/apex/PageName">Link using apex:outputlink</apex:outputlink>

<a href="{!$Page.PageName}">Link using $Page</a>

<a href="{!URLFOR($Page.PageName)}">Link using URLFOR()</a>

Similarly ensure all redirection happen via pagereference methods like below

public class customController {
  public PageReference getPage() {
    return new PageReference('/apex/PageName'); 
  }

 public PageReference getPage1() {
  return Page.PageName; 
 }
}