How to generate a pseudo random one time use code for request token

Question

To avoid CSRF attacks we use a security token and validate the request against the token. This could be achieved through, the below code to generate a token

$link = JRoute::_('index.php?option=com_comp&view=comview&task=action'&'.JSession::getFormToken().'=1');

to validate the token

JSession::checkToken('get') or die( 'Invalid Token' );

and the link generates like... http://localhost/index.php?option=com_comp&view=comview&task=action&231a817c6f53a732b6d70f3e2c3c5fcd=1

Now my question is: This token code is not a one time use code, many requests on the same token can be made.

So this does not actually satisfy the purpose.

I think the generate token and check token must be related and once it is checked, the next time we get a token should change the value.

Is there any code or function in Joomla that can do this ?

Answer 1

I also sometimes need to refresh the session token to prevent the user from using the back button or resubmitting the page. I do it in my controller with the below method

/**
 * Convenience method to refresh the session token to prevent the back button
 *
 * @return void
 * @since 0.0.2
 */
protected function refreshToken()
{
    $session = JFactory::getSession();
    $session->getToken(true);
}

This will make the original token invalid, so any forms submitted with the old token won't be able to be resubmitted.

Another option that I use for tokens that are not related to security is below

protected function getHash($object)
{
    return urlencode(md5(json_encode($object)));
}

I usually use this when I'm saving a one time use object to the user session. Then I follow up passing the hash in the redirect and unset the session variable when it gets to where it needs to be used.

Hope this helps =^D Happy Joomla!ng

Answer 2

The token is tied to the current user's session and is unique to that. As soon as that user has logged out then the token is no longer usable. i've never seen an issue with this set up for avoiding spoof attacks on forms, so I'm not sure you really have an issue to fix here.

However, to answer your quersion, what you can do to create a new token is:

JSession::getFormToken(true)