How can the p_auth authorization token be generated?

Legacy Knowledge Base

Published Jul. 2, 2025

How can the p_auth authorization token be generated?

Written By

Tony Ng

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

Liferay protects itself against CSRF attacks by generating the p_auth authorization token. How can this token be created?

Environment

DXP 7.0, 7.1, 7.2, 7.3

Resolution

When "auth.token.check.enabled=true" is set in portal-ext.properties, the auth token (p_auth value) is generated as a URL parameter. This only protects URLs generated from <portlet:actionURL> or <liferay-portlet:actionURL>.
Invoking "auth.token.check.enabled=true" will also work for MVC portlets.
When Action URLs are used for <aui:form action="X">, the AUI tag will extract the p_auth parameter and add this as a hidden field which is POST'ed to the server via the HTTP request body.
An indirect call to com.liferay.portal.kernel.security.auth.AuthTokenUtil#checkCSRFToken is made from com.liferay.portlet.SecurityPortletContainerWrapper#checkAction. This is fundamental to portlet container implementation.