I am writing an API and I want it to check that the data that has been entered came from a valid user session on my website.

The API uses Techjoomla's API Plugin.

When I send a 'POST' request to my API I am including the following header:

*token*: 1

Where *token* the name of an input element generated by the following code:

<?php echo JHtml::_('form.token'); ?>

However the following code cannot validate the token. (NB I am using this to test the function not as my actual csrf protection)


use Joomla\Session\Session;

class WdtoptionsApiResourceOptions extends ApiResource

    public function post()
        $result       = new \stdClass;

        if (JSession::checkToken()) 
        $result->tokencheck = 'valid';

        $result->tokencheck ='invalid';
        $this->plugin->setResponse( $result );


What am I doing wrong?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.