To ensure SFRA best practices and protect against request forgery, the developer introduced CSRF token generation in the customer address form:
<form … action = “submit”>
<input name =”${dw.web.CSRFProtection.getTokenName()}”
value = “${dw.web.CSRFProtection.generateToken()”>
…
<the rest of the Form fields>
…
</form>
To implement CSRF protection when the form is submitted, the developer needs to introduce the CSRF
validation using one or both of these methods as applicable:
validateRequest
validateAjaxRequest
Where in the code does the developer need to add this CSRF validation check?
- In the controller function that displays the form
- In the middleware chain of the controller post route
- In the controller function that handles the submitted form
- In the model function that persists the form data