How to get passed in parameters in URL EXCLUDING hidden parameters in Apex

Question

I'm familiar with ApexPages.currentPage().getUrl() which returns the second part of the url (/apex/Test!id=2314dsdf32) and also I know system.currentPageReference().getParameters() which basically does the same thing but returns these parameters in a map.

My issue is that the URL that I have for my page is something like this:

/apex/MyPage?var1=123&var2=abc

but when I use the above methods they return some additional variables that I don't see in my url (in browser) that's why I called them hidden parameters! Returned URL using .getURL() looks like this:

/apex/MyPage?var1=123&com.salesforce.visualforce.ViewStateCSRF=VmpFPSxNakF4Tnkwd0 5DMHlPVlF4TnpveU56bzFNaT&j_id0%3ASiteTemplate%3Aj_id39=j_id0%3ASiteTemplate%3Aj_ id39&var2=abc

How can I get rid of those variables and only see var1 and var2? Note that I want a solution that works the same for different pages for which I may have different variables, if they were always the same I would've got that from the map

Update

Since some of you asked I thought we need more explanation here. I have a template which lots of different pages will use this template. In the controller of this template I want to get the parameters of that page. That page may have no parameters or a few parameters and that is different (both in label/value) from page to page.

Answer 1

At your org, there is a protection against CSRF (Cross-Site Request Forgery).

All form requests made on the Force.com platform are protected. This is a setting in your Salesforce org that is enabled by default. The protection can only be disabled by contacting Salesforce.

You can see the CSRF setting at Setup -> Security Controls -> Session Settings.

With this setting enabled, whenever an Apex form is loaded, the platform includes a com.salesforce.visualforce.ViewStateCSRF parameter in the form, and that token is validated on submission. This token is inline with the previously mentioned anti-CSRF token requirements: it is unique per request and unique per user.

Refer Prevent Cross-Site Request Forgery (CSRF) Trailhead

Update based on comments

In your controller you can loop through for dynamic url parameters.

for(String param:ApexPages.currentPage().getParameters().keySet())
{
    if(param.equalsIgnoreCase('var1'))
    {
        String strValue = ApexPages.currentPage().getParameters().get(param);
    }
}

EDIT

You can create a custom settings or custom metadata type which will hold page reference basically referer and parameter names.

Following will give you who is calling your template page.

ApexPages.currentPage().getHeaders().get('Referer');

And in the controller, loop through the url parameters and try to match the custom settings/custom metadata types value and proceed with your logic.