Questions tagged [csrf]

Cross site request forgery

Filter by
Sorted by
Tagged with
0
votes
1answer
43 views

Preventing CSRF when POSTing to a standard controller with a custom extension (Visualforce)

We have an anti-CSRF token for Visualforce Pages - "Require CSRF protection on GET requests". This token is meant to restrict CSRF for pages involving GET type requests, e.g. the pages ...
0
votes
0answers
52 views

How to retrieve confirmation token in salesforce lightning LCC

Issue: We have a lightning app (in salesforce lightning) which is an iframe inside a Lightning Container Component (LCC) and sometimes while on the salesforce session the CSRF confirmation token ...
1
vote
1answer
228 views

Build URL in Apex to Visualforce page including CSRF token

I am looking at building my own e-signature plugin for CPQ since I just can't get the Docusign provided one to work correctly. The plugin requires me to return a redirectURL for the e-signature ...
2
votes
1answer
250 views

Go to Visualforce Page with CSRF protection enabled from a Lightning Component

I need to go to a Visualforce page from a Lightning Component. The page has CSRF protection enabled. I'm trying to use navigateToURL action but it causes the "The link you followed isn’t valid. This ...
3
votes
2answers
217 views

Is a component only launched from a quick action safe from CSRF?

I've got a component that is launched from a quick action and on init preforms some DML and redirects the user. It only implements these three interfaces and is not referenced anywhere else in the ...
1
vote
1answer
482 views

Risk of CSRF In Lightning Applications

Could a package fail security review due to a lightning application that executes an initialization action on load that creates a record? e.g. user visits https://[instance].lightning.force.com/c/...
0
votes
1answer
70 views

Summer 17 Critical update - CSRF Protection - How would it affect VF pages below version 27.0

The 'Require CSRF protection' option on VF Pages are available only for pages with API version 27.0 or later. I was wondering if activating the critical update (Allow CSRF Protection on GET Requests ...
0
votes
0answers
76 views

CSRF Changes for href

I want to know what changes need to be made in below VF code to manage CSRF changes- <a href='/apex/{!if(pd.programType == "Partner Professional Services" || pd.programType == "Solution ...
2
votes
1answer
5k views

The link you followed isn’t valid. This page requires a CSRF confirmation token

Whenever I enable Require CSRF protection on GET requests checkbox,it always display the below message: The link you followed isn’t valid. This page requires a CSRF confirmation token. Report ...
2
votes
1answer
2k views

Critical Update - Allow CSRF Protection on GET Requests to Visualforce Pages - Confusion as to what is being enabled

I'm unclear as to what this critical update changes for our Org in particular. Allow CSRF Protection on GET Requests to Visualforce Pages In our org, we already have the ability to require CSRF on ...
3
votes
0answers
114 views

How to Update Record on Page Load without Getting XSRF

How can we update records when the page loads without getting the Cross Site Request Forgery security issue? It would be good if it's explained for Classic and Lightning interface. Thanks
11
votes
1answer
923 views

CSRF (Cross-Site Request Forgery) in Visualforce Pages on Public Force.com Sites

Background On one of our public Salesforce Sites (Force.com Site) we allow users to create or/and update contacts "within" salesforce. To do so I'm using <apex:form>. In case Javascript is ...