To avoid CSRF attacks we use a security token and validate the request against the token. This could be achieved through, the below code to generate a token

$link = JRoute::_('index.php?option=com_comp&view=comview&task=action'&'.JSession::getFormToken().'=1');

to validate the token

JSession::checkToken('get') or die( 'Invalid Token' );

and the link generates like... http://localhost/index.php?option=com_comp&view=comview&task=action&231a817c6f53a732b6d70f3e2c3c5fcd=1

Now my question is: This token code is not a one time use code, many requests on the same token can be made.

So this does not actually satisfy the purpose.

I think the generate token and check token must be related and once it is checked, the next time we get a token should change the value.

Is there any code or function in Joomla that can do this ?

2 Answers 2


I also sometimes need to refresh the session token to prevent the user from using the back button or resubmitting the page. I do it in my controller with the below method

 * Convenience method to refresh the session token to prevent the back button
 * @return void
 * @since 0.0.2
protected function refreshToken()
    $session = JFactory::getSession();

This will make the original token invalid, so any forms submitted with the old token won't be able to be resubmitted.

Another option that I use for tokens that are not related to security is below

protected function getHash($object)
    return urlencode(md5(json_encode($object)));

I usually use this when I'm saving a one time use object to the user session. Then I follow up passing the hash in the redirect and unset the session variable when it gets to where it needs to be used.

Hope this helps =^D Happy Joomla!ng

  • Dear copy-paste coders, calling urlencode() on md5() output is totally useless. 3v4l.org/A60n7 None of the alphanumeric characters will be affected by urlencode(). There is never a reason to call urlencode() after md5(). Apr 5, 2021 at 22:39

The token is tied to the current user's session and is unique to that. As soon as that user has logged out then the token is no longer usable. i've never seen an issue with this set up for avoiding spoof attacks on forms, so I'm not sure you really have an issue to fix here.

However, to answer your quersion, what you can do to create a new token is:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.