title: Magento CSRF protection
body: <p>I am looking at custom forms in Magento. I saw these tutorials</p>
  
  <p><a href="http://fastdivision.com/2012/03/29/diy-magento-create-ajax-login-registration-forms-for-your-magento-theme/">http://fastdivision.com/2012/03/29/diy-magento-create-ajax-login-registration-forms-for-your-magento-theme/</a></p>
  
  <p><a href="http://inchoo.net/ecommerce/magento/magento-email/magento-custom-email-contact-form-with-notification-system/">http://inchoo.net/ecommerce/magento/magento-email/magento-custom-email-contact-form-with-notification-system/</a></p>
  
  <p>I did not see any mention of CSRF prevention, like checking a client token with one stored in a user session. I also looked in the Magento Contact Us form, and saw this but I do not think it relates to CSRF:</p>
  
  <pre><code>&lt;input type="text" name="hideit" id="hideit" value="" style="display:none !important;"&gt;
  </code></pre>
  
  <p>Does Magento have any default code for preventing CSRF? Does the $this->getRequest()->getParams() method of Mage_Core_Controller_Front_Action do anything automatically to prevent CSRF that I may be missing?</p>