0

The 'Require CSRF protection' option on VF Pages are available only for pages with API version 27.0 or later.

I was wondering if activating the critical update (Allow CSRF Protection on GET Requests to Visualforce Pages) would change the API versions of these pages? or would it be enforced on all the pages regardless of API version?

Improve this question

1 Answer 1

Reset to default
3

As far as I know (though looking over the Winter '18 release notes, which mentions that this critical update will be enabled for everyone as part of that release), the critical update you mention is only to allow you to set up CSRF protection on GET requests on a page-by-page basis (It shouldn't automatically turn that on for any existing page).

That option will likely only appear on Visualforce pages that have an API version >= 27.0, and I highly doubt that Salesforce would go and automatically change API versions of existing Visualforce pages (I'd imagine that would be at least as big of an undertaking as phasing-out TLS 1.0 was, if not bigger).

As usual, it would be prudent to enable this in a sandbox environment first so you can figure out exactly what it changes (and if it breaks existing code/pages/integrations/etc...)

Improve this answer
1
  • You are correct, this has absolutely no effect on existing code without further administrative intervention.
    – sfdcfox ♦
    Commented Aug 31, 2017 at 20:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .