An Adobe Commerce Developer is tasked with creating a custom form which submits its data...

According to the Magento Stack Exchange answer, form key validation is a security feature that prevents CSRF attacks by checking if the form key in the request matches the one generated by Magento. If the developer does not include the form_key in their custom form, the validation will fail and an error will be shown. Therefore, the developer needs to add the form_key to their requests by using getBlockHtml (‘formkey’) ?> in their template file. Verified References: https://magento.stackexchange.com/questions/95171/magento-2-form-validation

In Adobe Commerce, when handling POST requests from forms on the frontend, form key validation is enabled by default as a security measure to prevent Cross-Site Request Forgery (CSRF) attacks. This validation checks that the form submission is coming from the same origin by including a unique token (form key) in the request. If this form key is missing or incorrect, the request will fail, and an error message may be shown on the frontend.

In this scenario:

Since the developer has used \Magento\Framework\App\Action\HttpPostActionInterface, which is appropriate for handling POST requests, it’s likely that the error they encounter is due to missing form key validation.

The solution is to ensure that the form includes a hidden input field for the form key. Adobe Commerce automatically adds this key in forms if you use the \Magento\Framework\Data\Form\FormKey model to get the form key value.

To implement this:

Ensure the form includes the form key:

The form key should also be included in the POST data sent to the controller. If it’s missing, Adobe Commerce will not process the request.

Additional Resources:

Adobe Commerce Developer Guide: Form Key

Magento 2.4 Form Key and CSRF Protection