I'm familiar with ApexPages.currentPage().getUrl() which returns the second part of the url (/apex/Test!id=2314dsdf32) and also I know system.currentPageReference().getParameters() which basically does the same thing but returns these parameters in a map.

My issue is that the URL that I have for my page is something like this:


but when I use the above methods they return some additional variables that I don't see in my url (in browser) that's why I called them hidden parameters! Returned URL using .getURL() looks like this:

/apex/MyPage?var1=123&com.salesforce.visualforce.ViewStateCSRF=VmpFPSxNakF4Tnkwd0 5DMHlPVlF4TnpveU56bzFNaT&j_id0%3ASiteTemplate%3Aj_id39=j_id0%3ASiteTemplate%3Aj_ id39&var2=abc

How can I get rid of those variables and only see var1 and var2? Note that I want a solution that works the same for different pages for which I may have different variables, if they were always the same I would've got that from the map


Since some of you asked I thought we need more explanation here. I have a template which lots of different pages will use this template. In the controller of this template I want to get the parameters of that page. That page may have no parameters or a few parameters and that is different (both in label/value) from page to page.

  • The parameters you don't want will be consistent from page to page. Can you just figure out what parameters to ignore, and take all the rest? Commented Apr 26, 2017 at 19:30
  • How dynamic are your parameters? It sounds like you're opening yourself up to malicious or accidental SOQL injection (or Apex injection?) attacks unless you have some sense of what you care about. Commented Apr 26, 2017 at 19:31
  • @JeremyNottingham are those hidden params exactly the same in each page? even if it's part of a managed package, installed in different orgs? it would be simple in this case! I will update my question to give more context
    – ashkanent
    Commented Apr 26, 2017 at 21:28
  • @CharlesKoppelman I simplified my question so you don't need to deal with unnecessary complexities. In my case all of these URL parameters are handled in my controllers in a managed package and they all scan everything to make sure they're safe. But good point tho
    – ashkanent
    Commented Apr 26, 2017 at 21:38
  • the pages should be able to tell the template which params to look for. Commented Apr 27, 2017 at 17:02

1 Answer 1


At your org, there is a protection against CSRF (Cross-Site Request Forgery).

All form requests made on the Force.com platform are protected. This is a setting in your Salesforce org that is enabled by default. The protection can only be disabled by contacting Salesforce.

You can see the CSRF setting at Setup -> Security Controls -> Session Settings.


With this setting enabled, whenever an Apex form is loaded, the platform includes a com.salesforce.visualforce.ViewStateCSRF parameter in the form, and that token is validated on submission. This token is inline with the previously mentioned anti-CSRF token requirements: it is unique per request and unique per user.

Refer Prevent Cross-Site Request Forgery (CSRF) Trailhead

Update based on comments

In your controller you can loop through for dynamic url parameters.

for(String param:ApexPages.currentPage().getParameters().keySet())
        String strValue = ApexPages.currentPage().getParameters().get(param);


You can create a custom settings or custom metadata type which will hold page reference basically referer and parameter names.

Following will give you who is calling your template page.


And in the controller, loop through the url parameters and try to match the custom settings/custom metadata types value and proceed with your logic.

  • So probably I don't wanna disable this feature. Do you know of a way of skipping these parameters? I basically want to get the URL the way that I'd get it in my page using Javascript!
    – ashkanent
    Commented Apr 26, 2017 at 18:47
  • you have all the parameters which you are passing to the url. so whats the issue? Commented Apr 26, 2017 at 18:48
  • ApexPages.currentPage().getParameters().get('var1') will work in controller Commented Apr 26, 2017 at 18:49
  • I'd like to use something like ApexPages.currentPage().getParameters().keySet() to get all parameters that I have in URL (excluding CSRF, etc.) or at least have a way of distinguishing var1, var2 from CSRF or other similar parameters. (the issue is that var1, var2,... is not static in my pages, so I don't know which parameters to expect)
    – ashkanent
    Commented Apr 26, 2017 at 18:52
  • I've updated my question with more explanation. 'var1' is an example and this label can be anything, each page may have different URL parameters (some of them may have none, some may have 2, 3,... with different label/values)
    – ashkanent
    Commented Apr 26, 2017 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .