Joomla token with ajax request

Question

I've built a module that requests some data from the server via an ajax request. It includes the Joomla token to validate the session.

An odd thing is happening-- when I open Chrome and load the page, the module is populated correctly and the form token is validated.

I then open firefox to test, and the token validation fails-- but it's using the same token.

I'd assumed that the different browser would open a new session in Joomla and therefore get a new token.

Why is the same token being issued in two different browser sessions?

ADDING MORE INFO:

The controller does the token check like this:

JSession::checkToken('get') or die( 'Invalid Token');

The view makes the ajax request using the token as a URL variable:

index.php?option=com_mycomponent&format=raw&task=ajax.myTask&50e6a74276c578d2ebfc40fd526a193f=1

The token is generated using an ajax call to another function that generates the token using:

echo JFactory::getSession()->getFormToken();

This isn't great but it's the only way I've found to try to workaround Joomla's caching-- it tends to cache tokens generated in views when you need to embed them in ajax requests, so we request them from another service.

Answer 1

First of all this sounds very weird.

When opening the page in two browsers, Joomla should generate two different session ids (check the cookies that Joomla generates, they should be different!). This is because of the user agent.

Once the token is generated, it is basically saved in the session and the next time you call getFormToken() on the Session object, you get back the same object This indicates somehow that Joomla is using the same session!? But later fails to validate the same token?

You could try getFormToken(true) to force the generation of a new token - just for testing purposes.

With the amount of technical details you shared, these are the best ideas that I can think about.

Consider testing your module from a different machine, try incognito modes on your browser or share an example on github.

Hope this helps.