I've implemented a custom form directly within my Joomla article template's code. The form is processed by a handler located in my template. Everything worked fine until I decided to add a CSRF token to enhance security.

Here's how I'm inserting the token into the form within /templates/mytemplate/html/com_content/article/default.php:

<?php echo HTMLHelper::_('form.token'); ?>

And this is how I'm processing it in my handler at /templates/mytemplate/bookingHandler.php:

define('_JEXEC', 1);

use Joomla\CMS\Factory;
use Joomla\CMS\Mail\Mail;
use Joomla\CMS\Session\Session;

// Include Joomla Framework
define('JPATH_BASE', realpath(dirname(__FILE__) . '/../../'));
require JPATH_BASE . '/includes/defines.php';
require JPATH_BASE . '/includes/framework.php';

// Boot the DI container
$container = \Joomla\CMS\Factory::getContainer();

// Alias the session service key to the web session service
$container->alias(\Joomla\Session\SessionInterface::class, 'session.web.site');

// Get the application
$app = $container->get(\Joomla\CMS\Application\AdministratorApplication::class);

// Retrieve form data
$data = $_POST;

if (!Session::checkToken()) {
    header('Content-Type: application/json');
    echo json_encode([
        'success' => false,
        'message' => 'CSRF Token verification failed!',
        'debug' => [
            'receivedTokenName' => array_keys($_POST)[0],
            'receivedTokenValue' => $_POST[array_keys($_POST)[0]],
            'sessionData' => $_SESSION 

However, when submitting the form, I receive the following response in the console:

    "success": false,
    "message": "CSRF Token verification failed!",
    "debug": {
        "receivedTokenName": "5b9152ef2b44a22fa5e7a8f9e885c702",
        "receivedTokenValue": "1",
        "sessionData": "TzoyNDoiSm9vbWxhXFJlZ2lzdHJ5XFJlZ2lzdHJ5IjozOntzOjc6IgAqAGRhdGEiO086ODoic3RkQ2xhc3MiOjU6e3M6Nzoic2Vzc2lvbiI7Tzo4OiJzdGRDbGFzcyI6Mzp7czo3OiJjb3VudGVyIjtpOjE4O3M6NToidGltZXIiO086ODoic3RkQ2xhc3MiOjM6e3M6NToic3RhcnQiO2k6MTcwMDgxNDE4NztzOjQ6Imxhc3QiO2k6MTcwMDgyMTk0MTtzOjM6Im5vdyI7aToxNzAwODIyMzc3O31zOjU6InRva2VuIjtzOjMyOiJlZTUxMGQ1Nzc3YTI0ZWI0ZDI3ZGM4MWI4NDFhMDFiNSI7fXM6ODoicmVnaXN0cnkiO086MjQ6Ikpvb21sYVxSZWdpc3RyeVxSZWdpc3RyeSI6Mzp7czo3OiIAKgBkYXRhIjtPOjg6InN0ZENsYXNzIjowOnt9czoxNDoiACoAaW5pdGlhbGl6ZWQiO2I6MDtzOjEyOiIAKgBzZXBhcmF0b3IiO3M6MToiLiI7fXM6NDoidXNlciI7TzoyMDoiSm9vbWxhXENNU1xVc2VyXFVzZXIiOjE6e3M6MjoiaWQiO2k6MzY7fXM6MTk6InBsZ19zeXN0ZW1fd2ViYXV0aG4iO086ODoic3RkQ2xhc3MiOjE6e3M6OToicmV0dXJuVXJsIjtzOjUwOiJodHRwczovL3Rlc3QuY2FodWxhY3Rpdi5tZC9hZG1pbmlzdHJhdG9yL2luZGV4LnBocCI7fXM6OToiY29tX3VzZXJzIjtPOjg6InN0ZENsYXNzIjoxOntzOjExOiJtZmFfY2hlY2tlZCI7aToxO319czoxNDoiACoAaW5pdGlhbGl6ZWQiO2I6MDtzOjEyOiIAKgBzZXBhcmF0b3IiO3M6MToiLiI7fQ=="

ChatGPT's analysis suggested a discrepancy between the token sent from the form and the token stored in the session, hinting at potentially different user sessions between the form submission and the handler.

Why might these tokens be different, and how can I ensure the user session and the handler session are the same? Could there be a misconfiguration in how my Joomla application is bootstrapped or how sessions are handled?

1 Answer 1


You appear to be placing the token into an Article in the front-end Joomla Application, Site, but your bookingHandler.php is creating a backend or Administrator instance of Joomla with this line.

// Get the application
$app = $container->get(\Joomla\CMS\Application\AdministratorApplication::class);

I would suggest changing the above to create a Site application.

// Get the application
$app = $container->get(\Joomla\CMS\Application\SiteApplication::class);

You may also not be picking up the correct session details, these are what I use based on the core Joomla 4 files for the SiteApplication.

$container->alias('session.web', 'session.web.site')
    ->alias('JSession', 'session.web.site')
    ->alias(\Joomla\CMS\Session\Session::class, 'session.web.site')
    ->alias(\Joomla\Session\Session::class, 'session.web.site')
    ->alias(\Joomla\Session\SessionInterface::class, 'session.web.site');
  • Thank you very much. Your solution helped. Now I understand what the problem was. Commented Nov 26, 2023 at 9:25
  • What was the issue?
    – Irata
    Commented Nov 26, 2023 at 9:26
  • The issue was a CSRF token mismatch in my Joomla 4 custom form, caused by using a Joomla Administrator application instance in the back-end, which created a different session from the front-end form. Resolving it required switching to a Site application instance and aligning session service aliases to ensure consistent session and CSRF token handling. Commented Nov 26, 2023 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.