What is FreeMarker user.generateLinkUserToken(<string>)?

That is used by OOB components to prevent CSRF attacks (e.g. tricking a user to click on a url to perform an action they didn't intend to).

I believe the way this works on the backend, that token is included on links that are considered to be privileged (e.g. giving kudos), and it is checked on the server that it is the same value that is expected. 

So the only way it would be useful in freemarker, is if you could verify the value. 

Alternatively, what we do in Professional Services, is create our own random value, and store it in the user cache. We use that value on URLs that will typically call a custom endpoint. In that custom endpoint, we verify the value being sent with the one in the user cache.

MattV thank you for the quick reply here!

I believe the way this works on the backend, that token is included on links that are considered to be privileged (e.g. giving kudos), and it is checked on the server that it is the same value that is expected.

regarding this: Just to be clear, those are the hidden lia-action-token inputs commonly found on OOB forms? This came to mind because those have often been a culprit when trying to reproduce OOB features in custom components, let's say some kind of OOB form or OOB dropdown menus etc. Concrete example is when we are creating custom topic list views, OOB there is a feature for admins to batch process topics, but we always have to create some ugly workaround to provide an admin view that loads the original OOB component because we can't create a dropdown item to activate batch processing due to it being linked with a lia-action-token. The same then goes for handling batch processed items, OOB the added checkboxes are also linked to a lia-action-token.

If I could use that method to create the token that is found in those hidden inputs, it would allow me to re-create this kind of OOB functionality if the need arises. So it would be valuable to know if that method would generate these kind of tokens.

And if that is the case, the follow up question would be with what kind of string this method would need to be called with to create a valid token the server is going to accept when receiving the payload?