Device Fingerprint Snippet
Forter's device-fingerprint JavaScript collects behavioral signals (mouse movement, typing cadence, device fingerprinting) on every storefront page, from landing through checkout. The script loads from Forter's own CDN.
Once forterEnabled and forterSiteID are set (see Configure Decisions), it injects automatically. No template changes are needed.
sequenceDiagram
participant Browser
participant SFCC
participant Forter CDN
Browser->>SFCC: Any page load
SFCC-->>Browser: Inject Forter JS snippet (afterFooter hook)
Browser->>Forter CDN: Collect behavioral signals (async)
Forter CDN--)Browser: ftr:tokenReady event
Browser->>SFCC: POST token → ForterToken-SaveToken
Note over SFCC: Token stored in session.privacy.ftrTokenHow it works
- On ftr:tokenReady, the snippet POSTs the token to ForterToken-SaveToken, which stores it as session.privacy.ftrToken.
- From there, every Forter API call made during the rest of the session reads the token from session.privacy.ftrToken and includes it: order validation, login attempts, profile updates, and account changes.
- The token isn't cleared after use. It stays in the session until a fresh ftr:tokenReady event overwrites it or the session expires.
Content Security Policy (CSP)
If your storefront enforces a Content Security Policy, allow *.forter.com in your script-src directive.
Because the snippet also loads via inline <script> tags rather than a static <script src>, a strict policy may still block it even with *.forter.com allowed. Contact your Forter implementation team about compatibility options for your site.