Best practice for AJAX quieries

thats correct - you cant access these cookies from JS.
But php can do that, so just write something like

Code:

const CSRF = [ "<?= csrf_token() ?>", "<?= csrf_hash() ?>" ];