I have noticed this happen occasionally with a component I am working on. I use JHtml::_('form.token') in the form and JSession::checkToken() or die('Invalid Token') to check it once i receive the form data.

So it is triggering the die every time. One thought I have is that on the same page is a login form that uses form tokens (that form works). They also both use the same token.

Has something changed since this article http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms was published on how to use CSRF? For how simple it is to implement I just fail to see any way what I am doing is "failing".

I am using the latest version of Joomla (3.3.6 at the time of this posting).

UPDATE: Forgot to say, the form always uses POST.

2 Answers 2


FoF has a handy _csrfProtection routine in the controller, with several ways to check the token:

  • JUtility::getToken() (for Joomla 2.5, removed from Joomla 3.x)
  • $session->getToken()
  • $session->getFormToken()
  • or, the _token field in any of the previous instances


  • JUtility::getToken() has been removed from Joomla 3.x ;)
    – Lodder
    Nov 3, 2014 at 20:50
  • Yes, in FoF controller, there are several checks to support Joomla 2.5/3 in the same _csrfProtection.
    – Anibal
    Nov 3, 2014 at 20:52
  • I do rely on FoF to an extent for other things, I will check into this. Nov 3, 2014 at 20:54
  • Looked into it and noticed that the JSession::checkToken() was not returning "true", however doing it the same way FoF was bypassed that issue. Nov 4, 2014 at 17:12

Is it possible hat you submit your form with the "GET" method?

Because JSession::checkToken only validates against "POST" method, you have to use

JSession::checkToken('get') or die();

if you like to check the GET requests.

  • Not using GET, but good answer. Should of included that it was using POST in the question as well. Nov 3, 2014 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.