Introduction

ISML provides the <ISFORM> tag, which should be used instead of the HTML <FORM> tag when a form triggers security-relevant changes. During compilation this tag will be replaced with a regular HTML <FORM> tag and a hidden field for the synchronizer token. The token itself will be set by the Web Adapter when delivering the page. A CSRFServlet handles the token generation and delivers it to the Web Adapter.
To enable authorized users to pass CSRFGuard, a synchronizer token has to be injected into all forms that trigger security-relevant changes. For CSRFGuard it is inserted as hidden form field with a fixed name.
Using the <ISFORM> ISML tag allows for a server-side token injection. The serverside token injection is the preferred way, because the token is provided together with the HTML.

Syntax

<isform
  [ site = "( {String} | {ISML expression} )" ]
  [ serverGroup = "( {String} | {ISML expression} )" ]
  [ secure = "( true | false )" ] >
</isform>

Example

The example below shows the typical use of the <ISFORM> tag. HTML <FORM> attributes (e.g., action, name, method etc.) are passed through unaltered to the parsed <FORM> tag.

HTML tag

<isform
  action="#URL(Action('ViewApplication-ProcessLogin'))#"
  site="PrimeTech-Site"
  servergroup="WFS"
  name="LoginForm">
</isform>

Attributes

There are three optional attributes.

site

site = String | ISML Expression

The name of the site the form points to. Must be specified if the form points to another site than the one from the current request and the site can not be extracted from the form's action URL (i.e., if a short URL is used instead of the default URL(Action(...)) pattern). The site is necessary for the Web Adapter to get the session for the correct site. If no site is specified, the site of the current request is used.

serverGroup

serverGroup = String | ISML Expression

The server group the form points to. The server group must be specified if the form's action leads to another server group (i.e., if the server group cannot be extracted from the form's action URL). If not specified, the default "site server group -> current request server group -> WFS" will be used.

secure

secure = true | false

If set to true, an input field with type="hidden" holding the token will be inserted. If set to false, no hidden input field will be inserted. If the attribute secure is not specified its value depends on the value of the attribute method.