MENU
To ensure SFRA best practices and protect against request forgery, the developer introduced CSRF token generation in the customer address form.
To implement CSRF protection when the form is submitted, the developer needs to introduce the CSRF validation using one or both of these methods as applicable:
validateRequest
validateAjaxRequest
Where in the code does the developer need to add this CSRF validation check?
CSRF validation must occurwhen the state-changing request is submitted, before protected business logic executes. In SFRA this is implemented as middleware in the controller's POST route, using the appropriate CSRF middleware---validateRequestfor standard submissions orvalidateAjaxRequestfor AJAX-based requests.
Salesforce's SFRA Forms documentation specifically states that CSRF protection is supplied as middleware and demonstrates CSRF checks as middleware steps. The underlyingdw.web.CSRFProtection.validateRequest()API verifies that the request contains the system-generated token and that the token has not expired.
Generating the token in the template only establishes the client-side value; it does not provide security unless the receiving POST endpoint validates it. Placing validation only in the form-display route would validate the wrong request. Performing validation in a persistence model is also too late because request security should be enforced before mutation logic is invoked.
Study Guide reference:Application Development --- CSRF protection, SFRA middleware, POST routes,validateRequest,validateAjaxRequest, and secure form processing.
===============
Currently there are no comments in this discussion, be the first to comment!