Form definitions, validation, CSRF protection and bindings
When to build an SFRA form from a form definition, how attribute and function validation report errors, how CSRF tokens and middleware protect a post, and how getForm, req.form, clear() and copyFrom/copyTo move field values.
Given a requirement to accept, validate, and persist information from a storefront customer, modify the appearance of a form, add validation and cross-site request forgery (CSRF) protection, and use bindings to process fields.
~7 min read · 13 practice questions ·
What the exam expects
- Choose between a standard HTML form and a B2C Commerce form definition from the storage, validation and localization requirements.
- Configure server-side validation in a form definition (
mandatory,regexp,max-length, avalidationfunction) and predict which error message key a failed field shows. - Combine HTML5 client-side validation with server-side validation, and know where SFRA's client validation scripts live.
- Add CSRF protection with the SFRA middleware or with
CSRFProtectiontoken name, token value andvalidateRequest(). - Render, read, clear and prefill a form in an SFRA route (
server.forms.getForm,res.renderdata,req.form,clear()), and copy values between forms and objects with bindings.
Key terms: form definition (an XML file in the cartridge's forms folder describing fields, validation and the objects to store data in); in-memory form object (the session-scoped object built from a definition); CSRF token (a session-bound synchronizer token checked on submit); binding (the link copyFrom() creates between a form and the object its values came from); route:BeforeComplete (the route event used to store form data).
Key facts
- Detail
- Persists during the session unless explicitly cleared
max-length- Detail
- Validates strings only; formats length for other types
validation attribute- Detail
- Runs on a form, a group or an individual field
- Detail
- Makes the entire form invalid
- Detail
- Middleware step
csrfProtection.validateAjaxRequest
- Detail
- Tied to the session, valid for 60 minutes
- Detail
- System generated, not configurable, needed by
validateRequest()
- Detail
- Available on
req.form
copyTo()- Detail
- Updates only fields submitted with the form
- Detail
- Dynamic, multi-part, embedded and nested forms
- When is SFRA's
form-validationscript loaded? - Why would a team take form labels from Business Manager object metadata?
- When is a form group's action marked as triggered rather than only submitted?
- What does
getSubmittedAction()return when no action was submitted for the group?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the B2C Commerce Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 28 lessons of the B2C Commerce Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (13 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both