I need the record to be updated when the visualforce page loads. In the apex:page tag, I utilised the action property to invoke the apex method that executes update DML. Salesforce considers an onload update to be a CSRF attack. Is there a way to do this without a popup or notice on the page? According to what I've read is one technique to accomplish this is through Visualforce/JS remoting called from Javascript on load of the page.

Is it possible to achieve the same thing with apex:actionfunction, which is also called from Javascript?

For better understanding, below is a sample code.

Visualforce page:

<apex:page standardController="ABC__c" sidebar="false" showHeader="true" extensions="csrfController" >
<apex:pageBlock id = "block1">
<apex:actionFunction name="updateABCRecord" action="{!updateABCRecord}" oncomplete="" rerender="block1"/>
Welcome {!record.Name}, Your status is {!record.abc_status__c}.
<script type="text/javascript">

Apex class:

public with sharing class csrfController 
    public string recordid;
    public ABC__c record {get; set;};
    public csrfController(ApexPages.Standardcontroller controller)
        recordid = ApexPages.currentPage().getParameters().get('recordid');
        record = new ABC__c();
    public pageReference updateABCRecord()
        record = [SELECT Id,Name,abc_status__c,abc_payment__c from ABC__c where Id =: recordid];
        if(record.abc_payment__c = 'Made')
            record.abc_status__c = 'Closed won';
            update record;
        return null;

Note: Require CSRF protection on GET requests is set to true on the visualforce page.


  • You might find this helpful: salesforce.stackexchange.com/questions/319590/…
    – identigral
    Aug 17, 2021 at 19:12
  • @identigral Thank you for getting back to me. Could you perhaps give me an example of how to develop our own CSRF checks on Visualforce page and Apex methods with the use case mentioned?
    – Shine
    Aug 17, 2021 at 19:34

1 Answer 1


Doing so might not trigger a CSRF notice in a code scanner, but it is still a security risk. Any DML you perform should only be in response to a user performing some affirmative action besides just loading the page. The point of a CSRF is to use someone else's authorization in the system to perform an action.

So, if your page has any automation on load, and another user sends the first user an email (perhaps with deceptive language) and a link to your page, they can perform an action as someone else. Depending on that action, this could get the person who clicked on the link in trouble for doing something they should not have done.

P.S. an action method that doesn't need to redirect can use the void data type:

public void updateABCRecord() {

This makes it "self-documenting" that you do not want to redirect after performing the action.

  • Thank you for responding. Isn't that something that'll be taken care of by 'Require CSRF Protection on GET Requests'? Where plain links or typing the page's URL to view the page do not work. When you try to access a Visualforce page with CRSF protection enabled, you get an error instead of the page loading.
    – Shine
    Aug 17, 2021 at 19:15
  • @Shine Yes, but by the same token (no pun intended), that setting also protects against the CSRF problem that would be flagged by using the apex:page action problem. If you're relying on that setting, that's fine. Just be aware that any form of page where simply clicking on the link results in a DML operation is vulnerable to CSRF problems (i.e. using JS is no more or less secure than using the action parameter).
    – sfdcfox
    Aug 17, 2021 at 19:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .