AGENTFORCE-VF-02: Visualforce CSRF via page action
🔴 High · CSRF
Detects apex:page action="{!...}" which runs a controller method on GET — classic VF CSRF.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-VF-02 |
| Severity | High |
| Category | CSRF |
Remediation
Remove the page action attribute. Invoke state-changing logic from an apex:commandButton inside apex:form.