sf-b2c-controllers

sf-b2c-controllers

Build SFRA controllers for request handling in Salesforce B2C Commerce Cloud.

Before Writing Code

Fetch live documentation FIRST:

1. Web-search for:

   • "Salesforce B2C Commerce SFRA controllers documentation 2026"
   • "SFCC server module middleware patterns"
   • "B2C Commerce controller CSRF protection best practices"

2. Web-fetch official sources:

   • github.com/SalesforceCommerceCloud/storefront-reference-architecture (SFRA controllers)
   • Salesforce B2C Commerce server module API reference

3. Verify before coding: current server module syntax, middleware chain methods, CSRF validation requirements, form validation patterns in latest SFRA.

Conceptual Architecture

Controller Basics

Controllers are route handlers defined using the server module. Routes follow the naming convention ControllerName-ActionName (e.g., Product-Show, Cart-AddProduct).

• Controller file: controllers/Product.js
• Route: Product-Show
• URL: https://site.com/Product-Show?pid=12345

Every controller file ends with module.exports = server.exports();

Server Module Methods

Method	HTTP	Purpose	Example
server.get(name, ...mw, handler)	GET	Display pages	Product-Show, Cart-Show
server.post(name, ...mw, handler)	POST	Form submissions	Cart-AddProduct, Account-Register
server.use(name, ...mw, handler)	Any	Shared logic, API endpoints	Method-agnostic handlers

Middleware Chain

Middleware functions execute left to right before the final handler. Each must call next() to continue the chain.

server.post('Action',
  server.middleware.https,        -> 1. Force HTTPS
  csrfProtection.validateRequest, -> 2. Validate CSRF
  userLoggedIn.validateLoggedIn,  -> 3. Require login
  function (req, res, next) {}    -> 4. Handler
);

Common built-in middleware:

• server.middleware.https -- force HTTPS
• csrfProtection.validateRequest -- CSRF token validation
• csrfProtection.generateToken -- generate CSRF token for forms
• userLoggedIn.validateLoggedIn -- require authenticated user
• consentTracking.consent -- consent tracking check