Joomla CSRF form validation

Question

I have noticed this happen occasionally with a component I am working on. I use JHtml::_('form.token') in the form and JSession::checkToken() or die('Invalid Token') to check it once i receive the form data.

So it is triggering the die every time. One thought I have is that on the same page is a login form that uses form tokens (that form works). They also both use the same token.

Has something changed since this article http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms was published on how to use CSRF? For how simple it is to implement I just fail to see any way what I am doing is "failing".

I am using the latest version of Joomla (3.3.6 at the time of this posting).

UPDATE: Forgot to say, the form always uses POST.

Answer 1

FoF has a handy _csrfProtection routine in the controller, with several ways to check the token:

• JUtility::getToken() (for Joomla 2.5, removed from Joomla 3.x)
• $session->getToken()
• $session->getFormToken()
• or, the _token field in any of the previous instances

https://github.com/akeeba/fof/blob/development/fof/controller/controller.php#L3308

Answer 2

Is it possible hat you submit your form with the "GET" method?

Because JSession::checkToken only validates against "POST" method, you have to use

JSession::checkToken('get') or die();

if you like to check the GET requests.