Implement CSRF anti-spoofing using the Joomla Framework

Question

I have used the methods described on this page in Joomla many times before:

http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms

Now I want to implement the same mechanism using the Joomla Framework and the Framework App. So I have tried this:

$token = $this->app->getFormToken();

But this causes the application to exit. I have stepped through the code and the problem starts in the getFormToken function here:

return md5($this->get('secret') . $userId . $this->session->getToken($forceNew));

$this->get('secret') returns here because there is no dot in 'secret':

if (!strpos($path, '.'))
{
    return (isset($this->data->$path) && $this->data->$path !== null && $this->data->$path !== '') ? $this->data->$path : $default;
}

Then this function runs from Symfony:

public function write($sessionId, $data)
{
    return (bool) $this->handler->write($sessionId, $data);
}

And finally this function runs:

public function close()
{
    $this->active = false;

    return (bool) $this->handler->close();
}

Which exits the application.

What am I doing wrong? Do I need to add a 'secret' somewhere? How should I generate a form token which I then check when the form is submitted?

Answer 1

I finally worked it out. I needed to create a session and assign it to the app before getFormToken would work. So first I use the Joomla session:

use Joomla\Session\Session;

Then create the session, set it and get the form token:

$session = Session::getInstance('none');
$this->app->setSession($session);
$token = $this->app->getFormToken();

Easy when you know how! I hope this helps someone else.