On one of our public Salesforce Sites (Force.com Site) we allow users to create or/and update contacts "within" salesforce. To do so I'm using
- It looks like CSRF protection is not available for Salesforce Sites. (The hidden input field is missing)
- There is no CSRF protection for "public" Sites.
- How to enable CSRF protection on public Salesforce / Force.com Sites?
- Is there an alternative way to implement CSRF protection?
As a "Salesforce Standard User" there is CSRF protection:
On public sites CSRF protection is missing