Using checkToken() to secure form posts

Question

I am building a web app using the Jooma Framework and the Framework App as a template. I have getFormToken() working as described in this post and am now submitting the token with my form but I cannot get checkToken() working. This is the code I have so far to setup the session and get the token:

$session = Session::getInstance('none', $options);
$session->initialise($this->app->input);
$session->start();
$this->app->setSession($session);
$token = $this->app->getFormToken();

The problem in that on every page load, $token is a new value causing checkToken() to fail and exit the app. I can see that the session.token is correctly set in my $_SESSION variable when the next page starts loading but when I called getInstance to get the session, the first thing it does is call session_unset() and session_destroy() which clears session.token.

So how can I get access to the session without clearing it every time? Is there another way to check the form token that was created on a previous page load?

Many thanks,

Answer 1

I guess the code

$session = Session::getInstance('none', $options);

creates a new instance.

But what you need is to get the session that is active, try to use

$session =& JFactory::getSession();

I have not tried out but I know. Please let me know the results.

Thanks