Questions tagged [security-token]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
11
votes
5answers
5k views

Joomla 3.6.0 to 3.6.1 results in a “invalid security token” error

I've just tried to update my site from Joomla 3.6.0 to 3.6.1 and I get the following error message: The most recent request was denied because it contained an invalid security token. Please refresh ...
6
votes
2answers
704 views

How to generate a pseudo random one time use code for request token

To avoid CSRF attacks we use a security token and validate the request against the token. This could be achieved through, the below code to generate a token $link = JRoute::_('index.php?option=...
6
votes
1answer
410 views

Implement CSRF anti-spoofing using the Joomla Framework

I have used the methods described on this page in Joomla many times before: http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms Now I want to implement the same mechanism using the Joomla ...
6
votes
1answer
2k views

Joomla token with ajax request

I've built a module that requests some data from the server via an ajax request. It includes the Joomla token to validate the session. An odd thing is happening-- when I open Chrome and load the page,...
6
votes
1answer
1k views

Using checkToken() to secure form posts

I am building a web app using the Jooma Framework and the Framework App as a template. I have getFormToken() working as described in this post and am now submitting the token with my form but I cannot ...
5
votes
5answers
2k views

Invalid token after upgrading Joomla to 3.5

After upgrading my site to J3.5, users can't login anymore. They get the "invalid token" error. I tried myself around 30 times and I also get the error, although I can login to the admin area. I ...
3
votes
2answers
700 views

how to refresh Joomla token in form by AJAX

I've got a website that uses an AJAX call to login a user. To secure this, I've added a token to the login form - https://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms the problem is that, ...
3
votes
3answers
693 views

How to check JSESSION in javascript

I am developing a component and I use ajax calls to do some tasks in the frontend. I have come to a problem when the session is expires and I don't want to use keepalive to solve it. In the frontend ...
3
votes
2answers
1k views

Joomla CSRF form validation

I have noticed this happen occasionally with a component I am working on. I use JHtml::_('form.token') in the form and JSession::checkToken() or die('Invalid Token') to check it once i receive the ...
3
votes
1answer
258 views

Invalid Token - Login issue - Explaination of what is being compared

I have 2 very similar (but obviously not identical) environments - one test and one production. I am using only the standard Login form from a menu item. Yet, I get an Invalid Token when trying to log ...
2
votes
2answers
541 views

Joomla 3.4.x to 3.6.4 Update and invalid security token on front-end login

I have to update a Joomla 3.4.7 site. I did first a localhost update to test - everything worked fine. But now on the live site I am not able to login in the front-end. I am getting the invalid ...
2
votes
1answer
4k views

Token check not working in custom component admin

I've built a custom component and have three forms that executes different tasks in the default.php view on subcontrollers within the administrator. Within my tmpl view default.php, each form has a &...
2
votes
1answer
63 views

How to develop a survey extension which prevents respondents from taking a survey more than once?

I'm looking for advice on how to make a survey for my Joomla production (3.6.4) site. A key requirement is to restrict respondents to only taking the survey once (i.e. preventing 'ballot-box' ...
2
votes
1answer
1k views

Invalid Token - Login Issue

Joomla 3.4.1 I was hoping somebody could briefly explain this for me. I am not that familiar with tokens, sessions or cache. My site was working fine with no issues however I decided to enable the "...
1
vote
1answer
510 views

Joomla User Password Reset from an External (Standalone) Script

I have the requirement for a user to reset their password from a mobile application that links into a Joomla site. I have had success in logging in (authenticating and returning a sessionid) but don't ...
1
vote
1answer
539 views

AJAX POST request with form Token always responds with “Invalid Token”

I'm sending data from a form with AJAX. The data is a username and password of the user, and therefore I want to make it as secure as possible. I'm trying to use a token as an extra security layer, ...
1
vote
1answer
2k views

Joomla Invalid token / Session timeout issue

I have a site that is implemented in Joomla 3.1.5 on which the following are installed http://www.joomlart.com/joomla/templates/ja-muzic --> This is the theme http://www.jomsocial.com/ --> Used ...
1
vote
0answers
39 views

How does com_contact caching work when it has a form token?

I've been looking into conservative caching recently and felt I'd got my head around it. However, when I added it to a site, I was surprised to see that the core component com_content caches forms. ...
0
votes
2answers
44 views

How to properly verify whether there's a token or not - Joomla checkToken() function

I have a page with a form, this form redirects the user to another page, however the user can only access this page if the form has been subimitted, for that I check if there's any token. I have the ...
0
votes
1answer
290 views

How can I remove check for user data (invalid token error)

I've found a lot of advice on how to keep [invalid token] error from occurring. I've tried them and still have an issue. I just want to get rid of the check. Can anyone tell me off hand where I ...
0
votes
2answers
40 views

How to Add a global Function to a Component

Hello I have two token functions that I use in my bridge from Second Life(LSL Script) to joomla it creates a the Token for the info coming from and to SL on the site. Is there a way i can make these ...
0
votes
1answer
60 views

How to use component config permissions on the frontend?

I am having an issue with the Access component parameters from inside own component. I have tried the code listed in the first answer, but it did not work. Below is an image of the back end config ...
0
votes
1answer
410 views

Joomla 2.5 post with python to login

I´m trying to create an script to do fails logins in Joomla. I had a brutal force attack some days ago and the plugin Brutal Force Stop was failed, I have changed the database from MySQL to DynamoDB ...
0
votes
0answers
28 views

.htaccess redirect causes invalid security token when logging in thru email link

I wanted to eliminate duplicate content by redirecting all requests to https://www... by using the below .htaccess entry: ## Begin - Custom redirects # # If you need to redirect some pages, or set a ...
0
votes
1answer
30 views

Invalid security token locks out users trying to log in through an email link

I ran into the below problem that blocks my users to log into my site: When the user needs to log in she gets a notification email with a button that links to the below address: https://www....
0
votes
0answers
21 views

Generated URL with token - The security token did not match [duplicate]

I'm trying to make a link that acts as the "save 2 copy" button on the edit page. On the main page for the item, I am creating the link according to this documentation: https://docs.joomla.org/...
0
votes
1answer
137 views

Unable to log in to Joomla! front-end

When attempting to log in using the standard Joomla! login page, the following message is displayed: Warning The security token did not match. The request was aborted to prevent any security ...
0
votes
1answer
58 views

CheckToken() error when TinyMCE init

I have a form, which add some data to DataBase. <form> <input type="text" name="mydata" /> <textarea name="mytext"></textarea> <?php echo JHtml::_( 'form.token' );?> ...
0
votes
1answer
78 views

Random token in DB on each login

I'm looking to somehow add a "token" on login and temperately store it in the database (same as table *_users) until next login (important). I have a game of sorts that uses a selected user and ...
0
votes
2answers
572 views

Ajax request 303 redirect on a multilingual website

I have an ajax task to return a form token from my controller for use in ajax pages, so that subsequent ajax requests will have a token. It looks like this in the code: JURI::root().'index.php?option=...