To ensure SFRA best practices and protect against request forgery, the developer introduced CSRF token...

CSRF validation must occurwhen the state-changing request is submitted, before protected business logic executes. In SFRA this is implemented as middleware in the controller ' s POST route, using the appropriate CSRF middleware—validateRequestfor standard submissions orvalidateAjaxRequestfor AJAX-based requests.

Salesforce ' s SFRA Forms documentation specifically states that CSRF protection is supplied as middleware and demonstrates CSRF checks as middleware steps. The underlyingdw.web.CSRFProtection.validateRequest()API verifies that the request contains the system-generated token and that the token has not expired.

Generating the token in the template only establishes the client-side value; it does not provide security unless the receiving POST endpoint validates it. Placing validation only in the form-display route would validate the wrong request. Performing validation in a persistence model is also too late because request security should be enforced before mutation logic is invoked.

Study Guide reference:Application Development — CSRF protection, SFRA middleware, POST routes,validateRequest,validateAjaxRequest, and secure form processing.

===============