We have an anti-CSRF token for Visualforce Pages - "Require CSRF protection on GET requests".

This token is meant to restrict CSRF for pages involving GET type requests, e.g. the pages invoked from buttons on record detail page. Without the CSRF token we get this error "The link you followed isn’t valid. This page requires a CSRF confirmation token. Report this error to your Salesforce administrator." I was doing a kind of POC and found that this token when set to true for VF pages involving POST requests(e.g. the pages invoked from button on list view pages),the CSRF attack is still restricted. The VF page:

<apex:page standardcontroller="Account"  extensions="TestVFController"  recordsetvar="accs" action="{!init}">


the Controller for this page:

public with sharing class TestVFController {
public List<Account> Accounts{get; set;}

public TestVFController(ApexPages.StandardSetController setCon) {
    Accounts = setCon.getSelected();

public void init() {
    Contact newContact = new Contact(LastName = 'Test Contact');
    newContact.AccountId = Accounts[0].Id;
    insert newContact;

The DML is performed on page load and a new Contact is inserted.

Is this the possible mitigation for pages prone to CSRF and involving POST requests? Suggestions/answers will be much appreciated. Thanks!

  • @identigral, Thank you for your response! You mean to say the anti-CSRF token for Visualforce Pages - "Require CSRF protection on GET requests" for the VF page has no role for POST requests?? Sep 15, 2020 at 8:19
  • Okay, but when I perform POST request to the above page(mentioned in the question), disabling the "Require CSRF protection on GET requests" for the VF page, the action method on page load just fires and DML is performed ! Sep 15, 2020 at 13:24
  • @identigral, Can you point me to any official documentation regarding this? Thanks! Sep 21, 2020 at 8:29

1 Answer 1


Out of the box, the config settings that apply CSRF protection (both GET and POST) to Visualforce pages only work on standard controllers and methods. From the doc:

Within the Lightning Platform, Salesforce has implemented an anti-CSRF token to prevent this attack. Every page includes a random string of characters as a hidden form field. Upon the next page load, the application checks the validity of this string of characters and does not execute the command unless the value matches the expected value. This feature protects you when using all of the standard controllers and methods.

The code you posted in your question is using an extension of a standard controller. Therefore it will not be automatically protected against a CSRF attack by the platform. You'll need to implement your own CSRF checks by following standard, non-Salesforce specific best practices and/or using Salesforce-specific recommendations in Secure Coding Guide.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .