JRequest::checkToken() in model

[Nerijus]

Hi,

Do we really need "JRequest::checkToken() or jexit( 'Invalid Token' );" in each model function (like store, move, saveorder)?
Token checking is already done in controller.
Also having token check in ex. store method forbids model reuse on product importing from 3rd party services.

[Milbo]

No, does not forbid it, you can create a token.

[Nerijus]

But I have to create it and set in request. that means I can accidently create and set token for actions I was not inteded to or otherwise deny it (for examle if I create any thing in plugin on system event)

[Milbo]

But this is exactly what we want. You are forced to write more secure.