How to Completely Get Rid of the “Invalid Token” Error on Joomla

Note: The solution in this post is compatible with all versions of Joomla that are 2.5 and above (as of March 2015).

Another note: This solution will always work on compatible Joomla versions.

Warning: The solution in this post is a core modification – this means that your changes will be possibly wiped out with a future Joomla update.

Another warning: Go with the solution presented in this post only when you’re desperate – since this particular core modification may jeopardize the stability and security of your Joomla website. You have been warned!

Final warning: This solution should be temporary if you decide to implement it. You should locate the root cause of the “Invalid Token” issue and fix it there. (if you need help with that, we’re always there!)

Ah – invalid tokens – if we had a dime everytime a client calls us with an invalid token issue, we’d have a small jar full of dimes! Invalid tokens are by far the most annoying, frustrating, and loathed Joomla errors and they’re nearly impossible to fix. But, what most people do not know, is that one can get rid of these errors once and for all with just one line of code! Here’s how to do this:

• Open the file session.php located under the libraries/joomla/session folder.

• Locate this line:

  public static function checkToken($method = 'post')

• Just after the opening bracket (the {), add the following line:

  return true;

• Upload the file session.php back to your website.

• That’s it! You have solved the “Invalid Token” error on your Joomla website once and for all (well, at least until the next update of your Joomla website)!

Unbelievable, huh? Just one line of code in the right place marked the end of many, many hours (or many weeks, for some) of frustration.

But, doesn’t this solution seem like removing one small part of a car and claiming that it’s not needed?

Yes – that’s exactly what this solution is – but we’re not car repairmen and we’re not claiming that this functionality is not needed – it is needed! In fact, it prevents people from running automated queries in order to gain access to your website by directly submitting content to your forms instead of going through the normal process – and that is exactly why we wrote a warning at the beginning of this post that this should be only a temporary solution until a real fix is implemented.

So, will this solution really jeopardize the security of my Joomla website?

It might. As stated above, people won’t have to go through the normal process to submit actions to your website, which means that people may 1) login to your website using a brute force attack or 2) spam your website. Note that if you have a very strong password then the former possibility is a bit remote.

If you need help implementing this solution, or if you need help identifying and fixing the real problem, then please contact us. We can do the work for you in very little time and for a very affordable fee!