---
schema_version: "1"
id: 3cf8302f351ee280bc12622766457aa5b03383a73e70b4073a78c568db754164
title: CSRF Considerations for Salesforce Connect—OData 2.0 and 4.0 Adapters
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/odata_considerations_csrf.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.odata_considerations_csrf.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b015a51fc169a945adca4ac2887093bb6e8827848706a70a06eb834904a98e38
description: Understand the special behaviors, limitations, and recommendations for Cross-Site Request Forgery (CSRF) on OData external data sources.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# CSRF Considerations for Salesforce Connect—OData 2.0 and 4.0 Adapters

Understand the special behaviors, limitations, and recommendations for Cross-Site Request Forgery (CSRF) on OData external data sources.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience (not for high-data-volume
            external objects)</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Developer</strong> Edition</p>
            <p style="margin-bottom:0;">Available for an extra cost
              in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong>
              Editions</p>
          </td>

        </tr>
      </tbody>
    </table>

- CSRF protection isn’t available for high-data-volume external data sources.
- Make sure that the URL of the external data source starts with https:// so that secure HTTP can prevent unauthorized access to the anti-CSRF token and cookie.
- In addition to enabling CSRF protection on the external data source, we recommend keeping CSRF protection enabled in your org’s session security settings. These session settings are enabled by default, and keeping them enabled protects your Salesforce data and your external data from CSRF attacks.
    - Enable CSRF protection on GET requests on non-setup pages
    - Enable CSRF protection on POST requests on non-setup pages

#### See Also

- [Define an External Data Source for Salesforce Connect—OData 2.0 or 4.0 Adapter](https://help.salesforce.com/s/articleView?id=platform.platform_connect_add_external_data_source.htm&release=264.0.0&type=5 "Connect your Salesforce org to data that’s stored in an external system, such as SAP® NetWeaver Gateway, Microsoft Dynamics® NAV, or IBM WebSphere®.")
- [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&type=5&language=en_US)