3

I have noticed this happen occasionally with a component I am working on. I use JHtml::_('form.token') in the form and JSession::checkToken() or die('Invalid Token') to check it once i receive the form data.

So it is triggering the die every time. One thought I have is that on the same page is a login form that uses form tokens (that form works). They also both use the same token.

Has something changed since this article http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms was published on how to use CSRF? For how simple it is to implement I just fail to see any way what I am doing is "failing".

I am using the latest version of Joomla (3.3.6 at the time of this posting).

UPDATE: Forgot to say, the form always uses POST.

3

FoF has a handy _csrfProtection routine in the controller, with several ways to check the token:

  • JUtility::getToken() (for Joomla 2.5, removed from Joomla 3.x)
  • $session->getToken()
  • $session->getFormToken()
  • or, the _token field in any of the previous instances

https://github.com/akeeba/fof/blob/development/fof/controller/controller.php#L3308

  • JUtility::getToken() has been removed from Joomla 3.x ;) – Lodder Nov 3 '14 at 20:50
  • Yes, in FoF controller, there are several checks to support Joomla 2.5/3 in the same _csrfProtection. – Anibal Nov 3 '14 at 20:52
  • I do rely on FoF to an extent for other things, I will check into this. – Jordan Ramstad Nov 3 '14 at 20:54
  • Looked into it and noticed that the JSession::checkToken() was not returning "true", however doing it the same way FoF was bypassed that issue. – Jordan Ramstad Nov 4 '14 at 17:12
2

Is it possible hat you submit your form with the "GET" method?

Because JSession::checkToken only validates against "POST" method, you have to use

JSession::checkToken('get') or die();

if you like to check the GET requests.

  • Not using GET, but good answer. Should of included that it was using POST in the question as well. – Jordan Ramstad Nov 3 '14 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.