Questions tagged [csrf]

Cross site request forgery

Filter by
Sorted by
Tagged with
1
vote
0answers
73 views

How to handle deep links without CSRF tokens gracefully?

CSRF protection is mandatory now, and we have enabled it on our public site successfully, but as this previous answer notes, plain links (such as emailed URLs or bookmarks) to protected pages don't ...
1
vote
1answer
94 views

Preventing CSRF when POSTing to a standard controller with a custom extension (Visualforce)

We have an anti-CSRF token for Visualforce Pages - "Require CSRF protection on GET requests". This token is meant to restrict CSRF for pages involving GET type requests, e.g. the pages ...
1
vote
1answer
463 views

Build URL in Apex to Visualforce page including CSRF token

I am looking at building my own e-signature plugin for CPQ since I just can't get the Docusign provided one to work correctly. The plugin requires me to return a redirectURL for the e-signature ...
2
votes
1answer
361 views

Go to Visualforce Page with CSRF protection enabled from a Lightning Component

I need to go to a Visualforce page from a Lightning Component. The page has CSRF protection enabled. I'm trying to use navigateToURL action but it causes the "The link you followed isn’t valid. This ...
3
votes
2answers
247 views

Is a component only launched from a quick action safe from CSRF?

I've got a component that is launched from a quick action and on init preforms some DML and redirects the user. It only implements these three interfaces and is not referenced anywhere else in the ...
2
votes
1answer
622 views

Risk of CSRF In Lightning Applications

Could a package fail security review due to a lightning application that executes an initialization action on load that creates a record? e.g. user visits https://[instance].lightning.force.com/c/...
0
votes
1answer
71 views

Summer 17 Critical update - CSRF Protection - How would it affect VF pages below version 27.0

The 'Require CSRF protection' option on VF Pages are available only for pages with API version 27.0 or later. I was wondering if activating the critical update (Allow CSRF Protection on GET Requests ...
0
votes
0answers
81 views

CSRF Changes for href

I want to know what changes need to be made in below VF code to manage CSRF changes- <a href='/apex/{!if(pd.programType == "Partner Professional Services" || pd.programType == "Solution ...
5
votes
1answer
6k views

The link you followed isn’t valid. This page requires a CSRF confirmation token

Whenever I enable Require CSRF protection on GET requests checkbox,it always display the below message: The link you followed isn’t valid. This page requires a CSRF confirmation token. Report ...
2
votes
1answer
2k views

Critical Update - Allow CSRF Protection on GET Requests to Visualforce Pages - Confusion as to what is being enabled

I'm unclear as to what this critical update changes for our Org in particular. Allow CSRF Protection on GET Requests to Visualforce Pages In our org, we already have the ability to require CSRF on ...
3
votes
0answers
130 views

How to Update Record on Page Load without Getting XSRF

How can we update records when the page loads without getting the Cross Site Request Forgery security issue? It would be good if it's explained for Classic and Lightning interface. Thanks
11
votes
1answer
1k views

CSRF (Cross-Site Request Forgery) in Visualforce Pages on Public Force.com Sites

Background On one of our public Salesforce Sites (Force.com Site) we allow users to create or/and update contacts "within" salesforce. To do so I'm using <apex:form>. In case Javascript is ...