About is_ajax_request

Another question: there is some way to hide the ajax request link, or the entire js script? And about the csrf: to make the ajax request I disabled the csrf regenerate, is it secure? Or I must insert a data in the ajax request as my csrf token? Thank you!

I think that you must to use the maximum of security verifications. Then enable the CSRF Regenerate.

To use the CSRF dinamically you can get it on every submission. Or assign to a meta tag.

Some time ago I created a project doing it. Perhaps this lines can help: https://github.com/natanfelles/codeignit...e.php#L114

Thank you!