CSRF Token AJAX

Hi, yes, that would be the correct outcome if you have $config['csrf_regenerate'] = TRUE, which looks like you do.

The CI guide: "Tokens may be either regenerated on every submission (default) or kept the same throughout the life of the CSRF cookie. The default regeneration of tokens provides stricter security, but may result in usability concerns as other tokens become invalid (back/forward navigation, multiple tabs/windows, asynchronous actions, etc)."  - https://www.codeigniter.com/user_guide/l...rgery-csrf

As Kmycic states, you need to return a new CSRF token in your ajax response and then have JS update your form field if you wish to submit the form again.

In addition to that, you are using the form_open function which will add your CSRF token to the form, there is no need to add it directly to the java script function.  I would look at the ajax serialize function which will include the hidden CSRF token when the form is submitted.