---
schema_version: "1"
id: 8bea6e52055e6a0699d0b90f78c789dcb424130b9a632fe6deb91f4baa19a955
title: Create cross-site request forgery (CSRF) Allowlists for B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_configure_csfr_allowlist_settings.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_configure_csfr_allowlist_settings.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 6724c712d0cf7574f666e853220f3b24887a36fa30f6636f05b893cebdfe87c8
description: Configure how your site handles CSRF allowlists.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Create cross-site request forgery (CSRF) Allowlists for B2C Commerce

Configure how your site handles CSRF allowlists.

1. In Business Manager click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration > Global Preferences > Security** and select the CSFR Settings tab.
    
    Configure two types of CSRF allowlists: allowlists for pairs of pipelines and start nodes, and allowlists for user agents.
2. To allowlist a pipeline and start node, enter the names of the pipeline and start node in the Add Pipeline/Start Node to Allowlist fields, and click **Add Pipeline/Startnode**.
    
    Repeat this step to allow additional pipeline/startnode pairs.
3. To allowlist a user agent, select an instance type from the Instance Type dropdown, enter the name of the user agent in the Add UserAgent to Allowlist field, and click **Add UserAgent**.
    
    Repeat this step to allowlist additional user agents.
4. Click **Apply**.

#### See Also

- [CSRF Protection in Business Manager](https://help.salesforce.com/s/articleView?id=cc.b2c_csrf_protection_in_business_manager.htm&release=264.0.0&type=5 "A CSRF attack is a technique used by malicious attackers to force a victim to make a protected request to B2C Commerce Business Manager ― a request that can severely disrupt your eCommerce business.")