title: Invalid token with Joomla custom component
body: <p>I'm building a custom Joomla component and I added this to my form in my template (default.php) file (it is using a HTTP POST):</p>
  
  <pre><code>echo JHTML::_( 'form.token' ); //add hidden token field to prevent CSRF vulnerability
  </code></pre>
  
  <p>Then I check the token in my controller with:</p>
  
  <pre><code>JRequest::checkToken() or die( 'Invalid Token' );
  </code></pre>
  
  <p>But no matter what I do I get an Invalid Token. I have verified that a hidden type with a token is created in my form when I view sources on the html page. I also verified, in the controller, the value of the token is the same:</p>
  
  <pre><code>print_r(JUtility::getToken());
  </code></pre>
  
  <p>So if the token is the same value, why on earth is it exiting with an Invalid Token message?</p>
  
  <p><strong>EDIT:</strong> There is a key piece I failed to mention. My form is processed with jquery ajax in a separate js file that is added in my view.html.php. This is what the ajax POST looks like:</p>
  
  <pre><code>jQuery.ajax({
      type: 'POST',
      url: 'index.php?option=com_recordings&amp;task=deletevideos&amp;format=raw',
      data: {checkedarray:checked},
      success: function(data){
                 //delete row
      }
  });
  </code></pre>
  
  <p>The controller processes this:</p>
  
  <pre><code>function deletevideos()
  {
  
      $video_list = JRequest::getVar('checkedarray', 0, 'post', 'array');
      //print_r(JUtility::getToken());
      JRequest::checkToken() or jexit( 'Invalid Token' );     
  
      $model = &amp;$this-&gt;getModel();
      return $model-&gt;setDeleteVideos($video_list);
  }
  </code></pre>
  
  <p>This then goes to the model that does the DB update. I saw this old <a href="http://forum.joomla.org/viewtopic.php?p=1464422" rel="nofollow">post</a> that might be relevant. It is not clear to me how/where I generate the token and where/how I validate that token. The post seems quite involved as it checks against users as well which I don't think is needed in my case. Or maybe I misunderstand?</p>
  
  <p><strong>EDIT #2</strong></p>
  
  <p>Okay so the token is missing and I need to pass it into my js file. So I thought I could add this to my view.html.php:</p>
  
  <pre><code>    $addtoken = JUtility::getToken();
      $addtokenjs = 'jQuery(function() {
                      var token="'.$addtoken.'";
                      });';
      $doc-&gt;addScriptDeclaration( $addtokenjs );
      $doc-&gt;addScript(JURI::base()."components/com_recordings/js/recordings.js");
  </code></pre>
  
  <p>I have to put this in the document ready function because apparently addScriptDeclaration does not put anything ahead of my recordings.js file. Then pass the token into the <code>ajax</code> call:</p>
  
  <pre><code>jQuery.ajax({
      type: 'POST',
      url: 'index.php?option=com_recordings&amp;task=deletevideos&amp;format=raw'+token+'=1',
      data: {checkedarray:checked},
      success: function(data){
                 //delete row
      }
  });
  </code></pre>
  
  <p>Apparently I'm not doing this right as I get this error: <code>ReferenceError: token is not defined</code>.</p>