I have an issue with Visualforce Remoting.

The issue presents it self, when my visualforce page executes a remote call to the related custom apex controller. I can see the browser console log the following error:

Remoting request authorization expired. Refresh the page and try again.

The visualforce page in question, is made available to the user via the Service console in the utility bar, and will not get refreshed frequently, because the customer service console is a SPA type application. As a consequence, it actually makes sense for the remote call to fail at some point, because the CSRF token will expire after the session times out.

However... I see this error occur right from the get-go of a user's session. The session timeout is set to 2 hours

The problem was introduced with the winter '23 release (two weeks ago), which enforced a release update that implements stricter validation of remoting calls.


I have tried to disable the two session settings:

  • "Enable CSRF protection on GET requests on non-setup pages"
  • "Enable CSRF protection on POST requests on non-setup pages"

But that didn't help.

Any ideas as to why I'm seeing this error? And any ideas on how to get around it, other than making sure the visualforce page is refreshed now and then?

  • At the end of the help article which you linked, there is a note saying "To periodically refresh your page so that your CSRF token doesn't expire, add the Apex controller to a profile to grant access through the profile instead of the token." Did you try that? Did that work for you?
    – jagmohan
    Nov 8, 2022 at 5:39
  • Yes I tried that. It doesn’t work
    – Andreas86
    Nov 9, 2022 at 6:55
  • I'm running into a similar error but it happening intermittently for us. Please post here if you find a workaround.
    – jagmohan
    Nov 9, 2022 at 12:24
  • we have a workaround in place that refreshes the page after certain user events, to refresh the csrf token. It only reduced the amount of issues we see. But we still see errors. I have created a case with salesforce because they claim in this help article (help.salesforce.com/s/…) the token should refresh on its own as long as the profile has access to the apex class. This doesn't work
    – Andreas86
    Nov 9, 2022 at 13:34
  • Thanks for letting me know.
    – jagmohan
    Nov 9, 2022 at 14:07

1 Answer 1


After a lot of back and forth with support, I've found the answer for this (at least in our case).

If your code is unpackaged, then the workaround provided by Salesforce should be used (i.e. ensure profiles have access to the Apex controller for the Visualforce page). If your code is in a managed package, you need to make the class global. Obviously this isn't ideal in a managed package, but thankfully only the class itself needs to be global, the methods and properties etc. can remain public.

I've tested this approach with a brand new managed package installed in an org, with identical unpackaged code in the same org. The unpackaged code worked fine, the packaged code with a public controller failed, the packaged code with a global controller worked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .