Questions tagged [csrf]

Cross site request forgery

Filter by
Sorted by
Tagged with
0 votes
1 answer
66 views

CSRF Fix not working in LWC

Below is a dummy LWC component to update a Custom Object record field (Year__c) value. Dummylwc.html <template> <lightning-modal-header label="ANTI-CSRF TEST COMPONENT"><...
Brav's user avatar
  • 820
1 vote
0 answers
146 views

Uncaught TypeError: Cannot read properties of undefined (reading 'tid')

Recently I noticed our salesforce instance spitting the following into the console on user login Uncaught TypeError: Cannot read properties of undefined (reading 'tid') No changes have been made in ...
fom's user avatar
  • 11
3 votes
1 answer
1k views

Visualforce.Remoting returns "Remoting request authorization expired. Refresh the page and try again"

I have an issue with Visualforce Remoting. The issue presents it self, when my visualforce page executes a remote call to the related custom apex controller. I can see the browser console log the ...
Andreas86's user avatar
  • 357
1 vote
1 answer
448 views

PUT method of @future(callout=true) gives us 403 Forbidden error for the added remote site

I'm working on the trigger for the custom object, when we update the custom mail field, it has to be updated in the third-party API (which I've added in the remote site settings). As we know @future(...
Sivaskandhan Kumaraguru's user avatar
0 votes
1 answer
202 views

Will the use of apex:actionFunction result in a CSRF vulnerability?

I need the record to be updated when the visualforce page loads. In the apex:page tag, I utilised the action property to invoke the apex method that executes update DML. Salesforce considers an onload ...
Shine's user avatar
  • 1
1 vote
1 answer
717 views

CSFR Errors When Accessing VisualForce Page From Lightning Web Component Even With NavigationMixin

I've seen many questions on accessing Visualforce pages from LWC, including the following Is it possible to navigate to a Visualforce page from an LWC with parameters and community compatible however ...
RedQueries's user avatar
1 vote
0 answers
133 views

How to handle deep links without CSRF tokens gracefully?

CSRF protection is mandatory now, and we have enabled it on our public site successfully, but as this previous answer notes, plain links (such as emailed URLs or bookmarks) to protected pages don't ...
Foo Bar's user avatar
  • 296
1 vote
1 answer
678 views

Preventing CSRF when POSTing to a standard controller with a custom extension (Visualforce)

We have an anti-CSRF token for Visualforce Pages - "Require CSRF protection on GET requests". This token is meant to restrict CSRF for pages involving GET type requests, e.g. the pages ...
karan bhargava's user avatar
1 vote
1 answer
1k views

Build URL in Apex to Visualforce page including CSRF token

I am looking at building my own e-signature plugin for CPQ since I just can't get the Docusign provided one to work correctly. The plugin requires me to return a redirectURL for the e-signature ...
Daniel Hoechst's user avatar
3 votes
1 answer
768 views

Go to Visualforce Page with CSRF protection enabled from a Lightning Component

I need to go to a Visualforce page from a Lightning Component. The page has CSRF protection enabled. I'm trying to use navigateToURL action but it causes the "The link you followed isn’t valid. This ...
ArtemT's user avatar
  • 31
3 votes
2 answers
337 views

Is a component only launched from a quick action safe from CSRF?

I've got a component that is launched from a quick action and on init preforms some DML and redirects the user. It only implements these three interfaces and is not referenced anywhere else in the ...
bafuda's user avatar
  • 757
2 votes
1 answer
2k views

Risk of CSRF In Lightning Applications

Could a package fail security review due to a lightning application that executes an initialization action on load that creates a record? e.g. user visits https://[instance].lightning.force.com/c/...
bafuda's user avatar
  • 757
0 votes
1 answer
90 views

Summer 17 Critical update - CSRF Protection - How would it affect VF pages below version 27.0

The 'Require CSRF protection' option on VF Pages are available only for pages with API version 27.0 or later. I was wondering if activating the critical update (Allow CSRF Protection on GET Requests ...
Venkataraman's user avatar
0 votes
0 answers
112 views

CSRF Changes for href

I want to know what changes need to be made in below VF code to manage CSRF changes- <a href='/apex/{!if(pd.programType == "Partner Professional Services" || pd.programType == "Solution ...
Sam R's user avatar
  • 45
5 votes
1 answer
12k views

The link you followed isn’t valid. This page requires a CSRF confirmation token

Whenever I enable Require CSRF protection on GET requests checkbox,it always display the below message: The link you followed isn’t valid. This page requires a CSRF confirmation token. Report ...
SFDCDJ's user avatar
  • 1,864
2 votes
1 answer
3k views

Critical Update - Allow CSRF Protection on GET Requests to Visualforce Pages - Confusion as to what is being enabled

I'm unclear as to what this critical update changes for our Org in particular. Allow CSRF Protection on GET Requests to Visualforce Pages In our org, we already have the ability to require CSRF on ...
Bigears's user avatar
  • 1,131
3 votes
0 answers
177 views

How to Update Record on Page Load without Getting XSRF

How can we update records when the page loads without getting the Cross Site Request Forgery security issue? It would be good if it's explained for Classic and Lightning interface. Thanks
Abdullah Alsaadi's user avatar
11 votes
1 answer
1k views

CSRF (Cross-Site Request Forgery) in Visualforce Pages on Public Force.com Sites

Background On one of our public Salesforce Sites (Force.com Site) we allow users to create or/and update contacts "within" salesforce. To do so I'm using <apex:form>. In case Javascript is ...
Christian Deckert's user avatar