11

Background

On one of our public Salesforce Sites (Force.com Site) we allow users to create or/and update contacts "within" salesforce. To do so I'm using <apex:form>. In case Javascript is enabled the data is send via ajax to salesforce (custom endpoint); In case Javascript is disabled the standard "POST" request will send the data to salesforce.

Observations

  1. It looks like CSRF protection is not available for Salesforce Sites. (The hidden input field is missing)
  2. There is no CSRF protection for "public" Sites.

Questions

  1. How to enable CSRF protection on public Salesforce / Force.com Sites?
  2. Is there an alternative way to implement CSRF protection?

Screenshots

As a "Salesforce Standard User" there is CSRF protection:

CSRF protection

On public sites CSRF protection is missing

CSRF protection is missing

  • 1
    are both vf pages exactly the same? Just double checking because if you define an action attribute in the apex:page the csrf is lost.. – Guy Clairbois Jul 9 '14 at 12:58
  • It's the same page. – Christian Deckert Jul 9 '14 at 16:52
  • Great Question & very good observation! – AtulRajguru9 Jul 10 '14 at 7:10
2

Here is how you can implement CSRF protection for your public site:

You will need to define NewGuid() function which will generate GUID: Here is one example how you can implement GuidUtil.NewGuid().

Blob b = Crypto.GenerateAESKey(128);
String h = EncodingUtil.ConvertTohex(b);
String guid = h.SubString(0,8)+ '-' + h.SubString(8,12) + '-' + h.SubString(12,16) + '-' + h.SubString(16,20) + '-' + h.substring(20);
system.debug(guid);

In your controller create a variable CSRF_ID and in constructor set the value for this variable:

CSRF_ID = GuidUtil.NewGuid(); 

Once GuidUtil.NewGuid() is set use it in controller action method check the value of CSRF_ID and if its matching then the request is legitimate otherwise not.

Hope that it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.