Cross-Site Request Forgery (CSRF) is a malicious technique in which unauthorized commands are crafted (by a script or a link on a page, for example) to be sent by a user to a website that has been authenticated.

The CSRF protection options protect against the CSRF malicious exploit of pages in Salesforce by injecting a random character string into URL parameters or within an embedded field hidden in non-setup pages. The Salesforce system then verifies the injected characters string and only invokes the action when the returned value is the same as the value that's expected. There are various features for setting protection against CSRF attacks, as per the following sections.