Welcome Guest, Not a member yet? Register   Sign In
Correct way to re-generate CSRF for sequential AJAX calls
#1
Question 

I have a vague memory of seeing this being discussed in another thread, but I can't find it now.
Scenario:
  • Controller uses Model to fetch data and pass it onto View
  • View contains functionality to refresh data via JS/AJAX call
  • The first call succeeds, CSRF checks pass
  • The second call fails, CSRF checks do not pass
I understand why. The AJAX call goes through CI and the CSRF token is re-generated. Since the initial View is never re-loaded, the form field contains the previous CSRF token.

Now (at last) to my question:

What is best practice to "inform" the initial View of the new CSRF token? I was thinking about simply including it in the response from the AJAX call to the JS code in the View, and then letting the JS code update the form's CSRF field with the new value.

Can anyone see any security issues with this?

The first call won't succeed if the token is stale or invalid, so there won't be a new one generated. The refreshed CSRF token will only be passed back on a successful call.

-joho
Reply


Messages In This Thread
Correct way to re-generate CSRF for sequential AJAX calls - by joho - 08-24-2023, 02:14 AM



Theme © iAndrew 2016 - Forum software by © MyBB