# Form definitions, validation, CSRF protection and bindings

*B2C Commerce Developer Study Guide · Application Development · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/b2c-commerce-developer/application-development/form-definitions-validation-csrf-protection-and-bindings*

When to build an SFRA form from a form definition, how attribute and function validation report errors, how CSRF tokens and middleware protect a post, and how getForm, req.form, clear() and copyFrom/copyTo move field values.

- Certification: Salesforce B2C Commerce Developer
- Exam section: Application Development
- Study guide: https://www.certifyforce.com/study-guide/b2c-commerce-developer

**Official exam objective:**

> Given a requirement to accept, validate, and persist information from a storefront customer, modify the appearance of a form, add validation and cross-site request forgery (CSRF) protection, and use bindings to process fields.

## What the exam expects

- Choose between a standard HTML form and a B2C Commerce form definition from the storage, validation and localization requirements.
- Configure server-side validation in a form definition (`mandatory`, `regexp`, `max-length`, a `validation` function) and predict which error message key a failed field shows.
- Combine HTML5 client-side validation with server-side validation, and know where SFRA's client validation scripts live.
- Add CSRF protection with the SFRA middleware or with `CSRFProtection` token name, token value and `validateRequest()`.
- Render, read, clear and prefill a form in an SFRA route (`server.forms.getForm`, `res.render` data, `req.form`, `clear()`), and copy values between forms and objects with bindings.

Key terms: **form definition** (an XML file in the cartridge's `forms` folder describing fields, validation and the objects to store data in); **in-memory form object** (the session-scoped object built from a definition); **CSRF token** (a session-bound synchronizer token checked on submit); **binding** (the link `copyFrom()` creates between a form and the object its values came from); **`route:BeforeComplete`** (the route event used to store form data).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| In-memory form object | Persists during the session unless explicitly cleared | [Forms](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-forms.html) |
| `max-length` | Validates strings only; formats length for other types | [Forms](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-forms.html) |
| `validation` attribute | Runs on a form, a group or an individual field | [Forms](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-forms.html) |
| One invalid element | Makes the entire form invalid | [Forms](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-forms.html) |
| SFRA CSRF check | Middleware step `csrfProtection.validateAjaxRequest` | [Forms](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-forms.html) |
| CSRF token life | Tied to the session, valid for 60 minutes | [Class CSRFProtection](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-script-api/dw.web.CSRFProtection.html) |
| CSRF token name | System generated, not configurable, needed by `validateRequest()` | [Class CSRFProtection](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-script-api/dw.web.CSRFProtection.html) |
| Submitted values | Available on `req.form` | [Forms](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-forms.html) |
| `copyTo()` | Updates only fields submitted with the form | [Class FormGroup](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-script-api/dw.web.FormGroup.html) |
| Not in SFRA | Dynamic, multi-part, embedded and nested forms | [Forms](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-forms.html) |

## Check yourself

- When is SFRA's `form-validation` script loaded?
- Why would a team take form labels from Business Manager object metadata?
- When is a form group's action marked as triggered rather than only submitted?
- What does `getSubmittedAction()` return when no action was submitted for the group?

## Sources

- [Forms](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-forms.html)
- [Class CSRFProtection](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-script-api/dw.web.CSRFProtection.html)
- [Class FormGroup](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-script-api/dw.web.FormGroup.html)
- [Class Form](https://developer.salesforce.com/docs/commerce/b2c-commerce/references/b2c-script-api/dw.web.Form.html)
- [SFRA Features and Components](https://developer.salesforce.com/docs/commerce/b2c-commerce/guide/b2c-sfra-features-and-comps.html)
- [SFRA Server-side JavaScript: Global](https://salesforcecommercecloud.github.io/b2c-dev-doc/docs/current/sfrajsdoc/js/server/global.html)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the B2C Commerce Developer pack (USD $19): https://www.certifyforce.com/practice-exams