I've built a custom component and have three forms that executes different tasks in the default.php view on subcontrollers within the administrator. Within my tmpl view default.php, each form has a <?php echo JHtml::_('form.token'); ?> which renders a hidden field with a token as the name with a value of 1. I have a check in my subcontroller, JSession::checkToken() or die to determine if the token is valid.

The issue is that when submitting a form via POST, the POST data with the token and the function JSession::checkToken() that checks the token are not a match thus results in FALSE. After debugging the JSession class, I found that when it gets a token, it is NOT the same as the token being posted. I've searched Google but could find any solution that worked.

According to Joomla's documentation on CSRF, it's supposed to be as easy as adding <?php echo JHtml::_('form.token'); ?> and adding the check in the controller JSession::checkToken() or die.

How can the two tokens differ from the form POST and JSession class? Is there something else I maybe missing or have not added that is not in the Joomla doc?

  • 1
    It should work the way you did it. The tokens shouldn't differ as long as the session is the same.
    – Bakual
    Jul 1, 2014 at 6:14

1 Answer 1


A few things occur to me:

Are you sure you're submitting to a "site" controller, and not an "admin" controller? The token for a site vs. admin form will be different, since the session is different.

Are you sure you're submitting via POST? If you are submitting via GET you need to check the token using JSession::checkToken('get')

Are you sure that you have put the token field inside the form tags? You can view the source to confirm that this all looks correct.

  • Thanks for the first tip. It was validating the frontend token so that's why the check was failing. Jul 22, 2014 at 2:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.