Aksara CMS Icon
Main Navigation

\Aksara\Laboratory\Core->validToken()

The documentation and cheat sheet of our framework

validToken() validates a submitted security token.

Purpose

validToken() validates a submitted security token. It lets a controller customize Aksara Core behavior while keeping the request inside the built-in CRUD, rendering, permission, validation, and response pipeline.

When to Use

Use it near the beginning of a controller method to configure how Core handles the current request.

Reference

validToken(?string $token, string|array $allowedUris = [])

Parameters

ParameterTypeRequiredDefaultDescription
$token?stringYes-Submitted token value.
$allowedUrisstring|arrayNo[]Additional URI or URI list whose token may be accepted.

Return Value

bool

Returns true when the submitted token is accepted for the current route or allowed URI; otherwise returns false.

Behavior

validToken() stores request-level configuration on the controller. Call it before the permission, rendering, or form-processing step that depends on it.

[!CAUTION]

Do not bypass token validation for browser form submissions. API clients have their own token path, but normal POST requests should keep CSRF protection enabled.

Basic Usage

if (! $this->validToken($this->request->getPost('_token'), ['orders/create'])) {
    return throw_exception(403, phrase('The security token is invalid or expired.'));
}

Advanced Usage

$this->setTitle(phrase('Orders'))
    ->setIcon('mdi mdi-cart-outline')
    ->setPermission();

Complete Example

namespace Modules\Orders\Controllers;

use Aksara\Laboratory\Core;

class Orders extends Core
{
    public function index()
    {
        $this->setTitle(phrase('Orders'))
            ->validToken();

        return $this->render('orders');
    }
}

Result

The controller stores the configuration and applies it later in the current request lifecycle.

Notes

  • Call configuration methods before setPermission() or render() when those steps depend on the configured value.

Common Mistakes

  • Calling the method after the permission or render step that already needed it.
  • Spreading related configuration across distant parts of the controller.

Related Methods

Improve Documentation
updateData

Available Methods

addButton addClass addDropdown addField addFilter addSubmitButton addToolbar afterDelete afterInsert afterUpdate allowPublicFormSubmission allowTokenFrom beforeDelete beforeInsert beforeUpdate columnOrder columnSize databaseConfig debug defaultValue deleteBatch deleteData distinct fieldAppend fieldOrder fieldPosition fieldPrepend fieldSize formCallback from fromSubquery getMethod gridView groupBy groupEnd groupField groupStart having havingGroupEnd havingGroupStart havingIn havingLike havingNotIn ignoreQueryString insertData insertId itemReference join like limit mergeContent mergeField modalSize notGroupStart notHavingGroupStart notHavingLike notLike offset orGroupStart orHaving orHavingGroupStart orHavingIn orHavingLike orHavingNotIn orLike orNotGroupStart orNotHavingGroupStart orNotHavingLike orNotLike orWhere orWhereIn orWhereNotIn orderBy parentModule permitUpsert render renderForm renderRead renderTable restrictOnDemo searchable select selectAvg selectCount selectMax selectMin selectSubquery selectSum serialize serializeRow setAiContext setAlias setAttribute setAutocomplete setBreadcrumb setButton setDefault setDescription setField setHeading setIcon setMessages setMethod setOptionLabel setOutput setPermission setPlaceholder setPrimary setRelation setTemplate setTheme setTitle setTooltip setUploadPath setValidation sortable table unsetColumn unsetDelete unsetField unsetMethod unsetRead unsetSelect unsetToolbar unsetTruncate unsetUpdate unsetView updateData validToken validateForm verticalSchema viewOrder where whereIn whereNotIn