Token check not working in custom component admin

Question

I've built a custom component and have three forms that executes different tasks in the default.php view on subcontrollers within the administrator. Within my tmpl view default.php, each form has a <?php echo JHtml::_('form.token'); ?> which renders a hidden field with a token as the name with a value of 1. I have a check in my subcontroller, JSession::checkToken() or die to determine if the token is valid.

The issue is that when submitting a form via POST, the POST data with the token and the function JSession::checkToken() that checks the token are not a match thus results in FALSE. After debugging the JSession class, I found that when it gets a token, it is NOT the same as the token being posted. I've searched Google but could find any solution that worked.

According to Joomla's documentation on CSRF, it's supposed to be as easy as adding <?php echo JHtml::_('form.token'); ?> and adding the check in the controller JSession::checkToken() or die.

How can the two tokens differ from the form POST and JSession class? Is there something else I maybe missing or have not added that is not in the Joomla doc?

Answer 1

A few things occur to me:

Are you sure you're submitting to a "site" controller, and not an "admin" controller? The token for a site vs. admin form will be different, since the session is different.

Are you sure you're submitting via POST? If you are submitting via GET you need to check the token using JSession::checkToken('get')

Are you sure that you have put the token field inside the form tags? You can view the source to confirm that this all looks correct.