Hi,

I would like to know how to secure sensitive uri like "domain.name/user/delete/?id=28" I firstly thought I could use Phalcon\Security token generation and adding it to uris like this :

class Url extends \Phalcon\Mvc\Url {
    public function get($uri = null, $args = null){
        $uri = parent::get($uri, $args);
        if(strpos($uri, '?') !== false){
            $uri .= '&';
        } else {
            $uri .= '?';
        }
        return $uri .= 'token=' . $this->getDI()->getShared('security')->getToken(32);
    }
}

Then, in my controllers checking it like this :

$this->security->checkToken('token', $this->request->getQuery('token'))

But this doesn't seem to work, it returns false. I also tried to use getSessionToken but both are different.

Can anyone help me ?

Thanks ;)

EDIT : I even try to create the token like this :

$this->getDI()->getShared('security')->getTokenKey() . '=' . $this->getDI()->getShared('security')->getToken(32)

But it doesn't work either.