I've built a custom component and have three forms that executes different tasks in the default.php view on subcontrollers within the administrator. Within my tmpl view
default.php, each form has a
<?php echo JHtml::_('form.token'); ?> which renders a hidden field with a token as the name with a value of 1. I have a check in my subcontroller,
JSession::checkToken() or die to determine if the token is valid.
The issue is that when submitting a form via POST, the POST data with the token and the function
JSession::checkToken() that checks the token are not a match thus results in
FALSE. After debugging the JSession class, I found that when it gets a token, it is NOT the same as the token being posted. I've searched Google but could find any solution that worked.
According to Joomla's documentation on CSRF, it's supposed to be as easy as adding
<?php echo JHtml::_('form.token'); ?> and adding the check in the controller
JSession::checkToken() or die.
How can the two tokens differ from the form POST and JSession class? Is there something else I maybe missing or have not added that is not in the Joomla doc?