SFCC Reference Architecture
The cartridge integrates via SFRA hooks and controller extensions. SFRA's base controllers and templates are never modified.
The two cartridges
Cartridge | Role |
|---|---|
int_forter_sfra | Core storefront integration — hooks, controller extensions, DTOs, services, the device-fingerprint template, and the order-status sync job. |
bm_forter | Business Manager extension — credential verification, order search by Forter decision, abuse-policy configuration, account-protection settings. |
Hooks (hooks.json)
Hook | Script | Purpose |
|---|---|---|
app.template.afterFooter | templateHooks.js | Device-fingerprint JS injection |
app.validate.order | validateOrder.js | Pre-authorization fraud decision |
app.post.auth | postAuthorizationHandling.js | Post-authorization fraud decision, plus pre-auth-decision mirror onto the order |
app.payment.saved | paymentSavedHandling.js | Payment-save capture for PSP flows that bypass the standard save-payment route |
Beyond the hooks
- Controller extensions for account-protection events — Account.js, Address.js, PaymentInstruments.js — extend the base SFRA controllers.
- DTOs (scripts/lib/forter/dto/) — the cartridge sends a raw snapshot of the order/customer; Forter maps it to its canonical schema server-side.
- Order-status sync job (ForterOrderUpdateSFRA) — a scheduled job that reports lifecycle changes (shipped, cancelled, refunded) back to Forter asynchronously.