FAQ-000238 - CSRF and DML Security Issues / Security Review and Documentation

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

Current FAQ

Question
My security scanner flagged a CSRF issue, but I have implemented a mitigation. How do I document this for the security review?
Answer
To document your CSRF mitigation for the AppExchange Security Review, follow these steps: 1. **Describe the Mitigation Approach**: Clearly explain the method you used, such as implementing per-request or session-based CSRF tokens. Include details about how the token is generated, its randomness, and how it is validated. 2. **Provide Implementation Details**: Share technical specifics about how the CSRF token is integrated into your solution. For instance, explain how the token is included in requests (e.g., custom headers or hidden form fields) and how the server validates it. 3. **Document Testing and Validation**: Include details about the testing performed to ensure the CSRF mitigation is effective. Mention any tools or methods used to confirm that the token cannot be guessed or reused. 4. **Address False Positives**: If any flagged vulnerabilities are false positives, explain why they are not valid concerns. Provide evidence, such as code snippets or test results, to support your claims. 5. **Attach Supporting Materials**: Include relevant documentation, such as code samples, test results, or reports from security tools, to substantiate your implementation. Make sure to upload this documentation to the security review wizard in the AppExchange Partner Console as part of your submission.
Enhancing FAQ...

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
ApexCSRFVfCsrf
Question
My security scanner flagged a CSRF issue, but I have implemented a mitigation. How do I document this for the security review?
Recommended Answer Update
To document your CSRF mitigation for the AppExchange Security Review, follow these steps: 1. **Describe the Mitigation Approach**: Clearly explain the method you used, such as implementing per-request or session-based CSRF tokens. Include details about how the token is generated, its randomness, and how it's validated. 2. **Provide Implementation Details**: Share technical specifics about how the CSRF token is integrated into your solution. For instance, explain how the token is included in requests (e.g., custom headers or hidden form fields) and how the server validates it. 3. **Document Testing and Validation**: Include details about the testing performed to ensure the CSRF mitigation is effective. Mention any tools or methods used to confirm that the token cannot be guessed or reused. 4. **Address False Positives**: If any flagged vulnerabilities are false positives, explain why they're not valid concerns. Provide evidence, such as code snippets or test results, to support your claims. 5. **Attach Supporting Materials**: Include relevant documentation, such as code samples, test results, or reports from security tools, to substantiate your implementation. Make sure to upload this documentation to the security review wizard in the AppExchange Partner Console as part of your submission.
Reasoning
Minor wording improvement was made to align with the conversational tone guidelines by changing 'they are not' to the contracted form 'they're not' in step 4. This makes the text more natural and conversational while maintaining all the original technical content and structure. For the related security rules selected: 1. **ApexCSRF** - This rule directly relates to the FAQ content which discusses CSRF issues flagged by security scanners and how to document CSRF mitigations. The FAQ's entire focus is on addressing CSRF vulnerabilities, which is exactly what the ApexCSRF rule detects and helps prevent. 2. **VfCsrf** - This rule is relevant because many AppExchange applications use Visualforce pages, and the FAQ's guidance on documenting CSRF mitigations would apply to Visualforce-based CSRF issues as well. The documentation approach described in the FAQ would be used for mitigations related to VfCsrf rule violations.
Reasoning References