I've built a module that requests some data from the server via an ajax request. It includes the Joomla token to validate the session.
An odd thing is happening-- when I open Chrome and load the page, the module is populated correctly and the form token is validated.
I then open firefox to test, and the token validation fails-- but it's using the same token.
I'd assumed that the different browser would open a new session in Joomla and therefore get a new token.
Why is the same token being issued in two different browser sessions?
ADDING MORE INFO:
The controller does the token check like this:
JSession::checkToken('get') or die( 'Invalid Token');
The view makes the ajax request using the token as a URL variable:
The token is generated using an ajax call to another function that generates the token using:
This isn't great but it's the only way I've found to try to workaround Joomla's caching-- it tends to cache tokens generated in views when you need to embed them in ajax requests, so we request them from another service.