{"id":419,"date":"2012-01-12T07:51:06","date_gmt":"2012-01-12T12:51:06","guid":{"rendered":"http:\/\/blogs.wp.stage.cpanel.net\/?p=419"},"modified":"2012-01-12T07:51:06","modified_gmt":"2012-01-12T12:51:06","slug":"making-your-script-work-with-security-tokens-in-cpanel-whm","status":"publish","type":"post","link":"https:\/\/devel.www.cpanel.net\/blog\/products\/making-your-script-work-with-security-tokens-in-cpanel-whm\/","title":{"rendered":"Making your script work with security tokens in cPanel & WHM"},"content":{"rendered":"
What is a security token?<\/strong> So, what does a \u201csecurity token\u201d look like? Take, for example, this URL: With security tokens enabled, this would become: In that example, cpsessYYYYYYY is the token unique to that logged-in user on that browser. (You can learn more about security tokens in cPanel & WHM by reading our Security Tokens white paper.) In order for your custom script to work with cPanel & WHM, every URL involved needs to be compatible with the security token. <\/p>\n Creating security token-compatible URLs<\/strong><\/p>\n Fortunately, it is very easy to do! <\/p>\n The token is available in the environment variable ‘cp_security_token’.<\/p>\n If security tokens are not in use, ‘cp_security_token’ will be an empty string.<\/p>\n If security tokens are in use, ‘cp_security_token’ will be, in terms of the above example: \/cpsessYYYYYYY<\/p>\n Note the preceding slash! Since the variable has that slash, the examples will work whether cPanel & WHM has security tokens enabled or disabled.<\/p>\n to this:<\/p>\n if ( !(\"CPANEL\" in window) ) CPANEL = {}; END_SECURITY_TOKEN_JAVASCRIPT<\/code><\/p>\n Next, make your URLs compatible by changing this:<\/p>\n to this:<\/p>\n What is a security token? \u201cSecurity token\u201d URLs were added in cPanel & WHM 11.25 as a security measure, and they were enabled by default in version 11.28. They help combat a common type of attack called a Cross-Site Request Forgery (XSRF). So, what does a \u201csecurity token\u201d look like? Take, for example, this URL: […]<\/p>\n","protected":false},"author":77,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[49],"tags":[],"class_list":["post-419","post","type-post","status-publish","format-standard","hentry","category-products"],"acf":[],"yoast_head":"\n
\n\u201cSecurity token\u201d URLs were added in cPanel & WHM 11.25 as a security measure, and they were enabled by default in version 11.28. They help combat a common type of attack called a Cross-Site Request Forgery (XSRF).<\/p>\n
\nhttps:\/\/example.com:2087\/i\/love\/cpanel<\/code><\/p>\n
\nhttps:\/\/example.com:2087\/cpsessYYYYYYY\/i\/love\/cpanel<\/code><\/p>\n
\n
\nSimply change this:<\/p>\nmy $APIurl = \"http:\/\/127.0.0.1:2087\/xml-api\/$url\";<\/code><\/p>\n
my $APIurl = \"http:\/\/127.0.0.1:2087$ENV{'cp_security_token'}\/xml-api\/$url\";<\/code><\/li>\n
\nFirst, make it available to your JavaScript. For example:<\/p>\nprint <<"END_SECURITY_TOKEN_JAVASCRIPT"; <\/p>\n
\n CPANEL.security_token = \"$ENV{'cp_security_token'}\";<\/p>\nvar ajaxURL = '\/3rdparty\/ZZZ\/zzz.cgi';<\/code><\/p>\n
var ajaxURL = CPANEL.security_token + '\/3rdparty\/ZZZ\/zzz.cgi';<\/code><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"