cPanel Blog

What is a security token?

“Security token” URLs were added in cPanel & WHM 11.25 as a security measure, and they were enabled by default in version 11.28. They help combat a common type of attack called a Cross-Site Request Forgery (XSRF).

So, what does a “security token” look like? Take, for example, this URL:

https://example.com:2087/i/love/cpanel

With security tokens enabled, this would become:

https://example.com:2087/cpsessYYYYYYY/i/love/cpanel

In that example, cpsessYYYYYYY is the token unique to that logged-in user on that browser.

 (You can learn more about security tokens in cPanel & WHM by reading our Security Tokens white paper.)

In order for your custom script to work with cPanel & WHM, every URL involved needs to be compatible with the security token. 

Creating security token-compatible URLs

Fortunately, it is very easy to do! 

The token is available in the environment variable 'cp_security_token'.

If security tokens are not in use, 'cp_security_token' will be an empty string.

If security tokens are in use, 'cp_security_token' will be, in terms of the above example: /cpsessYYYYYYY

Note the preceding slash!  Since the variable has that slash, the examples will work whether cPanel & WHM has security tokens enabled or disabled.

• Here's how you'd use it in Perl code that calls one of our API URLS.
  

  Simply change this:

  my $APIurl = "http://127.0.0.1:2087/xml-api/$url";

  to this:

  my $APIurl = "http://127.0.0.1:2087$ENV{'cp_security_token'}/xml-api/$url";

• Here's how you might use it in JavaScript for, say, an AJAX call.
  

  First, make it available to your JavaScript. For example:

  
    print <<"END_SECURITY_TOKEN_JAVASCRIPT"; 
<script type="text/javascript">
    if ( !("CPANEL" in window) ) CPANEL = {};
    CPANEL.security_token = "$ENV{'cp_security_token'}";
</script>
END_SECURITY_TOKEN_JAVASCRIPT

  
  Next, make your URLs compatible by changing this:

var ajaxURL = '/3rdparty/ZZZ/zzz.cgi';

to this:

var ajaxURL = CPANEL.security_token + '/3rdparty/ZZZ/zzz.cgi';