Fixes #10675: Added docs for disabling CSRF validation in standalone …

…actions

docs/guide/security-best-practices.md

@@ -209,11 +209,36 @@ class SiteController extends Controller
 }
 ```
 
+Disabling CSRF validation in [standalone actions](structure-controllers.md#standalone-actions) must be done in `init()`
+method. Do not place this code into `beforeRun()` method because it won't have effect.
+
+```php
+<?php
+
+namespace app\components;
+
+use yii\base\Action;
+
+class ContactAction extends Action
+{
+    public function run()
+    {
+          $model = new ContactForm();
+          $request = Yii::$app->request;
+          if ($request->referrer === 'yiipowered.com'
+              && $model->load($request->post())
+              && $model->validate()
+          ) {
+              $model->sendEmail();
+          }
+    }
+}
+```
+
 Further reading on the topic:
 
 - <https://www.owasp.org/index.php/CSRF>
 
-
 Avoiding file exposure
 ----------------------