Discuss Salesforce CCM-101 Exam Topic 6 Question 64

To ensure SFRA best practices and protect against request forgery, the developer introduced CSRF token

generation in the customer address form:

To implement CSRF protection when the form is submitted, the developer needs to introduce the CSRF

validation using one or both of these methods as applicable:

validateRequest

validateAjaxRequest

Where in the code does the developer need to add this CSRF validation check?

AIn the controller function that displays the form

BIn the middleware chain of the controller post route

CIn the controller function that handles the submitted form

DIn the model function that persists the form data

Suggested Answer: B

Get Premium CCM-101 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Jettie 11 months ago

Agreed, validation needs to happen right after form submission!

Lili 11 months ago

Definitely in the controller that handles the form submission.

Samuel 11 months ago

Wait, can you really validate in the model? Seems off.

Mica 11 months ago

I think it should be in the middleware chain instead.

Sharen 11 months ago

CSRF tokens are essential for form security!

Billye 12 months ago

I vaguely recall that the validation should happen before any data is processed, so maybe it should be in the controller function that handles the submitted form?

Malinda 12 months ago

I feel like we practiced a similar question, and I might have chosen the middleware option then. But now I'm confused if that’s the right place for CSRF validation.

Belen 1 year ago

I think it makes sense to add the CSRF validation in the controller function that handles the submitted form, right? That way, it checks the token right before processing the data.

Cherelle 1 year ago

I remember we discussed CSRF tokens in our last class, but I'm not sure if the validation should go in the controller or middleware.

Tasia 1 year ago

Okay, let me think this through. The CSRF token is generated in the form, so the validation needs to happen before the form data is actually processed. That means the validation check should be in the controller function that handles the submitted form, not in the middleware or the model.

Cyril 1 year ago

I think the key here is that the CSRF protection needs to be implemented at the point where the form data is being processed, which would be the controller function that handles the submitted form. The middleware chain of the controller post route seems like a good place to add the validation check.

Youlanda 1 year ago

Hmm, I'm a bit confused. The question mentions both validateRequest and validateAjaxRequest, so I'm not sure if the validation needs to be done in different places depending on whether it's a regular form submission or an AJAX request.

Mose 1 year ago

This seems straightforward. The CSRF token is generated in the form, so the validation check needs to be done when the form is submitted, which would be in the controller function that handles the submitted form.

Salesforce CCM-101 Exam - Topic 6 Question 64 Discussion