Could a package fail security review due to a lightning application that executes an initialization action on load that creates a record?

e.g. user visits https://[instance].lightning.force.com/c/MyApp.app?contactId=abcd & this creates a 'Receipt' record.

I've read about CSRF tokens in VisualForce, but no such thing for lightning applications. Is there maybe built in CSRF protections built into requests to AuraEnabled methods?


Lightning components can also be vulnerable to CSRF attacks .

Infact Salesforce security blog documents this


It's important to avoid doing DML on component onload .Would recommend adding a refresh or an action button on the component and asking user to click and confirm the action to prevent the security vulnerability.

Note that your app may definitely fail because of CSRF not being mitigated in lightning components .

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.