On one of our public Salesforce Sites (Force.com Site) we allow users to create or/and update contacts "within" salesforce. To do so I'm using <apex:form>. In case Javascript is enabled the data is send via ajax to salesforce (custom endpoint); In case Javascript is disabled the standard "POST" request will send the data to salesforce.


  1. It looks like CSRF protection is not available for Salesforce Sites. (The hidden input field is missing)
  2. There is no CSRF protection for "public" Sites.


  1. How to enable CSRF protection on public Salesforce / Force.com Sites?
  2. Is there an alternative way to implement CSRF protection?


As a "Salesforce Standard User" there is CSRF protection:

CSRF protection

On public sites CSRF protection is missing

CSRF protection is missing

  • 1
    are both vf pages exactly the same? Just double checking because if you define an action attribute in the apex:page the csrf is lost.. Jul 9, 2014 at 12:58
  • It's the same page. Jul 9, 2014 at 16:52
  • Great Question & very good observation! Jul 10, 2014 at 7:10

1 Answer 1


Here is how you can implement CSRF protection for your public site:

You will need to define NewGuid() function which will generate GUID: Here is one example how you can implement GuidUtil.NewGuid().

Blob b = Crypto.GenerateAESKey(128);
String h = EncodingUtil.ConvertTohex(b);
String guid = h.SubString(0,8)+ '-' + h.SubString(8,12) + '-' + h.SubString(12,16) + '-' + h.SubString(16,20) + '-' + h.substring(20);

In your controller create a variable CSRF_ID and in constructor set the value for this variable:

CSRF_ID = GuidUtil.NewGuid(); 

Once GuidUtil.NewGuid() is set use it in controller action method check the value of CSRF_ID and if its matching then the request is legitimate otherwise not.

Hope that it helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .