{"id":419,"date":"2012-01-12T07:51:06","date_gmt":"2012-01-12T12:51:06","guid":{"rendered":"http:\/\/blogs.wp.stage.cpanel.net\/?p=419"},"modified":"2012-01-12T07:51:06","modified_gmt":"2012-01-12T12:51:06","slug":"making-your-script-work-with-security-tokens-in-cpanel-whm","status":"publish","type":"post","link":"https:\/\/devel.www.cpanel.net\/blog\/products\/making-your-script-work-with-security-tokens-in-cpanel-whm\/","title":{"rendered":"Making your script work with security tokens in cPanel & WHM"},"content":{"rendered":"

What is a security token?<\/strong>
\n\u201cSecurity token\u201d URLs were added in cPanel & WHM 11.25 as a security measure, and they were enabled by default in version 11.28. They help combat a common type of attack called a Cross-Site Request Forgery (XSRF).<\/p>\n

So, what does a \u201csecurity token\u201d look like? Take, for example, this URL:
\nhttps:\/\/example.com:2087\/i\/love\/cpanel<\/code><\/p>\n

With security tokens enabled, this would become:
\nhttps:\/\/example.com:2087\/cpsessYYYYYYY\/i\/love\/cpanel<\/code><\/p>\n

In that example, cpsessYYYYYYY is the token unique to that logged-in user on that browser. (You can learn more about security tokens in cPanel & WHM by reading our Security Tokens white paper.) In order for your custom script to work with cPanel & WHM, every URL involved needs to be compatible with the security token. <\/p>\n

Creating security token-compatible URLs<\/strong><\/p>\n

Fortunately, it is very easy to do! <\/p>\n

The token is available in the environment variable ‘cp_security_token’.<\/p>\n

If security tokens are not in use, ‘cp_security_token’ will be an empty string.<\/p>\n

If security tokens are in use, ‘cp_security_token’ will be, in terms of the above example: \/cpsessYYYYYYY<\/p>\n

Note the preceding slash! Since the variable has that slash, the examples will work whether cPanel & WHM has security tokens enabled or disabled.<\/p>\n