Cross-site request forgery (CSRF or XSRF) , also know as One Click Attack, is a web security vulnerability that allows an Attacker / Hacker to attack on web application & to induce authenticated users to perform actions that they do not intend to perform.
Cross Site Request Forgery = Cross Site + Request Forgery
Cross-Site Request Forgery Working Model
Attackers using multiple social engineering technique to attack by using CSRF or XSRF, This technique working as The victim into clicking a URL that having maliciously crafted or set of maliciously crafted , unauthorized request for a specific Web application, Then user’s browser sending this maliciously crafted or set of maliciously crafted request to a targeted Web application. The request also includes any credentials information to the particular website (user session or cookies). Id use as from of an active session with a targeted Web application, the application response this new request as an authorized request submitted by the authorized user. Finally, The attacker successfully exploited the Web application infected with CSRF vulnerability.
There are multiple below cases, to attack CSRF
Submitting or deleting a record Form
Submitting a transaction Form
Purchasing a product Form
Changing a password Form
Sending a message Form
Contact Form
Application Prevent Against Cross-Site Request Forgery Attack
Preventing CSRF Attack, requires the inclusion of an unpredictable token in the body or URL of each HTTP request. Such tokens should at a minimum be unique per user session as well as be unique per request.
Properly validate submission form before the relevant action is executed
The preferred option is to include the unique token in a hidden field. The unique token can also be included in the URL itself, or a URL parameter.
Check Referrer field of each request.
Use Captcha on all critical page.
CSRF is a common form of attack and has ranked several times in the OWASP Top Ten (Open Web Application Security Project).
The main reason, the Object Manager directly is that direct use of the Object Manager causes the extension not to be installable in compiled production mode.
Never call the object manager directly because the Magento 2 Framework handles this automatically
By 2017, The Magento 2 Marketplace runs a compile and install test on all extensions by using properly Magento 2 Coding Standard. If your extension uses the Object Manager directly, it will fail these tests and be rejected from the Marketplace until you resolve this problem and reupload.
Magento 2 Logs having ecommerce store information records for the analysis purpose, as each functionality of ecommerce store either working fine or not, Its both status store in log files One of the most common examples of such events is the error log. Logs file store path
Step [4] – Create Controller Index.php file under your module Controller Index directory. Add below content in this file.
File Path=Mage2db/John/Controller/Index/Index.php
<?php
namespace Mage2db\John\Controller\Index;
class Index extends \Magento\Framework\App\Action\Action
{
public function execute()
{
echo 'Hello Mage2DB Magento 2 Learning & Knowledge & Troubleshooting';
exit();
}
}
All storefront controllers have to contain a public execute method. It is called when accessing the controller. The storefront controllers are inherited from \Magento\Framework\App\Action\Action class.
Magento 2 Standard, use of the echo & exit () is totally prohibited here we have used only for Testing Purpose.
Step [5] – Finally your custom controller has been created
Run the following below commands at your Magento 2 root directory
Tier prices are specific promotional technique to provide different set of discount on products, on the bases of product’s quantity, product’s discount applied.
Magento 2 store owner , apply this promotional technique , while customers are trying to purchase bulk products, normally this promotional technique for B2B business, on the special occasion B2C also apply to atrract more customers & generate more revenue
Example :: Here different set of discount applied of product (Affirm Water Bottle) as below
Step[1] – Tier Disocunt – 1
Buy 6 For $5.95 Each and Save 15%
Step[2] – Tier Disocunt – 2
Buy 12 For $5.60 Each and Save 20%
Step[3] – Tier Disocunt – 3
Buy 24 For $5.25 Each and Save 25%
Here three set of discount apply on the bases of quantity.
