The controller doesn't have Aura\Session\Manager object. Aura\Framework\Web\Controller\AbstractPage; use Aura\Session\Manager as SessionManager; . Place a token value unique to each authenticated user session in each form; and..