Security

The Security tab of a form decides who may submit it. You choose one or more authorization policies, and a submission is accepted only when they allow it. Use it on any form that should not be open to everyone, such as a members-only update form.

Set up form security

1. In the admin, open Forms and open the form.
2. Choose the Security tab. On a new form, choose a database on the Details tab first, or the tab stays disabled.
3. Choose the authorization policies to apply.
4. Save the form.

The tab saves the chosen policies as the form's authorization policies. The list of policies comes from your instance, so create the policy first if you need a new one.

Why it matters

A form definition must say who owns its submissions. Insites forms use anyone, so the policy list is the only guard. A form with no policy accepts a submission from anyone who sends one, with or without your web page.

Example policy

---
name: members_signed_in
redirect_to: /sign-in
---
{%- if context.current_user.id != blank -%}
true
{%- else -%}
false
{%- endif -%}

Every path of a policy must print true or false.

Common mistakes

• Leaving a public form with no spam protection. Policies decide who; spam protection, set on the Details tab, stops automated sending.
• Expecting a missing CSRF token to block a submission. It does not; the request arrives with no signed-in user, so a policy that checks the user refuses it.
• Applying a policy that redirects to a page the visitor cannot open either.

• Authorization policiesWhat a policy is.
• Forms overviewBuild forms.