FAQ-000205 - CSRF and DML Security Issues / General CSRF Prevention and Best Practices

To address CSRF vulnerability findings in Salesforce security reviews, follow these steps: 1. **Use CSRF Tokens**: Implement a per-request CSRF token. If that's not feasible, use a single CSRF token per session with sufficient entropy. Ensure all Visualforce pages and components include a CSRF token. Set the `confirmationTokenRequired` attribute to `true` for Visualforce pages to mitigate risks. 2. **Avoid Automated DML Operations**: Refrain from performing DML operations on component load. Require user interaction, like a button click, to initiate these operations. 3. **Require User Interaction**: Avoid triggering DML operations automatically on page load. Require user actions like button clicks to initiate operations. 4. **Enable ConfirmationTokenRequired**: For Visualforce pages, set the `ConfirmationTokenRequired` attribute to true to ensure CSRF protection. 5. **Custom Headers for API Requests**: Include CSRF tokens in custom headers for added security. 6. **Validate User Interactions**: Add user interaction for any redirection and enable token-based authentication to validate the redirection. 7. **Follow Secure Coding Practices**: Adhere to Salesforce's secure coding guidelines to prevent vulnerabilities. Check out the [CSRF mitigation guide](https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/secure_code_violation_request_forgery.htm) for detailed instructions. 8. **Reassess and Validate**: Run updated security scans to ensure all vulnerabilities are mitigated before resubmitting for review. 9. **Handle False Positives**: If vulnerabilities persist, verify if they are false positives and document them for the security review. 10. **Test Thoroughly**: Validate the implementation of CSRF tokens and assess their entropy to ensure they provide adequate protection. These practices will help you effectively address CSRF vulnerabilities and enhance your application's security.