Lua snippet

Secure NUI Bridge with Token Validation

Lua

jakemilner· 20/08/2026

Implements a tokenized NUI callback system to block unauthorized inspect-element JavaScript injection attacks in the browser layer.

Lua

-- CLIENT-SIDE
local sessionToken = nil

RegisterNUICallback('ui:ready', function(_, cb)
    sessionToken = exports['core']:GenerateSessionToken()
    cb({ token = sessionToken })
end)

RegisterNUICallback('ui:submitAction', function(data, cb)
    if not sessionToken or data.token ~= sessionToken then
        print("[Security] Unauthorized NUI payload detected!")
        cb({ status = 'unauthorized' })
        return
    end

    TriggerServerEvent('core:server:processNuiAction', data.action, data.payload)
    cb({ status = 'ok' })
end)

function ToggleUI(display)
    SetNuiFocus(display, display)
    SetNuiFocusKeepInput(false)
    SendNUIMessage({
        action = "SET_VISIBILITY",
        visible = display
    })
end

Secure NUI Bridge with Token Validation

Comments (0)