security [@since 9.1]

security exposes APIs for security-related functionality.

import security from "@sitevision/api/common/security";

security.csrf

csrf provides methods for working with CSRF protection.

security.csrf.getToken()

Used to acquire the current csrf-token. If the user is anonymous or if csrf-protection is disabled on the server this will return null.

security.csrf.getParameterName()

Used to acquire the parameter name that should be used when passing the token as a form field.

security.csrf.getHeaderName()

Used to acquire the header name that should be used when passing the token as a request header.

Tip! If you are using the requester when doing xhr-requests then all CSRF management will be taken care of automatically.

security.captcha [@since 2026.08.1]

captcha exposes methods for rendering and verifying a captcha in a form. It uses the captcha settings configured for the current site. WebApps currently support reCAPTCHA and Friendly Captcha v2. The SDK contains both server and client specific functions.

The captcha SDK does not support Friendly Captcha v1 at the moment.

For more example usage, see the sub page captcha example usage.

Server

security.captcha.isEnabled()

Returns true when captcha is enabled, correctly configured and supported by WebApps.

security.captcha.render()

Returns markup for the configured captcha. Render the returned markup as HTML inside the form. Returns an empty string when captcha is not available.

security.captcha.verify()

Verifies the captcha response in the current request. Returns true only when the response is valid. Captcha verification is not applied automatically. A WebApp that requires captcha must verify the response server-side before processing the request.

Captcha example, fetch the captcha widget and verify the solution, index.js

import router from '@sitevision/api/common/router';
import security from '@sitevision/api/common/security';

router.get("/", (req, res) => {
  const captcha = security.captcha.render();

  res.agnosticRender(renderToString(<App captcha={captcha} />), {
    captcha,
  });
});

router.post('/submit', (req, res) => {
   if (security.captcha.isEnabled() && !security.captcha.verify()) {
      return res.status(400).send('Captcha verification failed');
   }

   // Process the form submission.
});

Captcha example, render the form and captcha widget and send the action, App.js

import router from "@sitevision/api/common/router";
import * as React from "react";

const App = ({ captcha }) => {
  return (
    <form action={router.getUrl("/submit")} method="POST">
      <div dangerouslySetInnerHTML={{ __html: captcha }} />
      <input type="text" name="text" />
      <input type="submit" value="Submit" />
    </form>
  );
};

Client

security.captcha.init() [@since 2026.08.1.3]

Retriggers initiation of captcha widgets. If the captcha widget does not render correctly, you might need to retrigger the initiation. I.e. needs to be called if you render the captcha widget only on the client. See captcha example usage for more information.

security.captcha.getState(container) [@since 2026.08.1.3]

Locates a captcha widget and returns an object with information about the current captcha status. Use a an element or an id to locate the desired captcha widget. For example, the form element or the id of the form the widget protects. The function will locate the captcha within the provided container.

Expected output
Property	Type	Description
`captchaId`	string	The html element id of the captcha widget.
widget	element	The html element of the captcha widget.
provider	string	The name of the captcha provider. google or friendly.
state	string	The current state of the captcha. Available states: pending, verified, expired, error.
valid	boolean	Boolean indicating wether the current captcha status is solved or unresolved.

svCaptcha:stateChanged event [@since 2026.08.1.3]

To get live status updates for captcha widgets. Subscribe to the svCaptcha:stateChanged event utilizsing the events.on SDK. The callback parameter contains the same information as the return for security.captcha.getState(container).

svCaptcha:stateChanged

// Event tiggers when captcha state changes
events.on("svCaptcha:stateChanged", (status) => {
   // All captcha widgets emit the same event, ensure that the event is for the widget in this form
   if (formRef.current.contains(status.widget)) {
      setDisabled(!status.valid); // Disable/enable on invalid/valid
   }
});

Did you find the content on this page useful?