When standard CSRF protection solutions don't work for all use cases in Salesforce, you can try these approaches:
1. **Visualforce Pages**:
- Enable the `confirmationTokenRequired` attribute in the Visualforce page settings. This ensures GET requests require a CSRF token in the URL, making the page inaccessible without it. Configure this in your org's Visualforce page settings.
2. **Lightning Components (LWC/Aura)**:
- Avoid performing state changes or DML operations during component instantiation (e.g., in `connectedCallback` or `renderedCallback`). Instead, trigger these operations through explicit user actions, like button clicks.
3. **Custom Solutions**:
- Implement user interaction for any redirection and use token-based authentication to validate redirection requests. This adds an extra layer of security.
- Use CSRF tokens and ensure the `confirmationTokenRequired` attribute is set to "True."
- Add user interaction, like requiring a button click, before initiating any redirection or DML operations.
- Enable authentication by tokens to validate redirections and ensure they are legitimate.
4. **General Best Practices**:
- Protect all form requests and state-changing operations by requiring user actions to trigger them. Avoid executing DML operations in constructors or automatically initiated methods.
- Review and update your code to ensure all user interactions are secure and properly validated.
For more detailed guidance, refer to Salesforce's Secure Server-Side Development module and the Metadata API Developer Guide. If standard solutions don't address your specific needs, you should open a case with Salesforce Support for tailored guidance.