CSRF only on POST request, reason?

Is there any way to control the error message if the token is invalid or missing? Atm it loads a error view template. I would like to have it return JSON.

You can do this by creating an application/core/MY_Security class which extends CI_Security. The simplest solution would be to override just the csrf_show_error() method, which would probably also be fairly easy to maintain in the long term (currently, in both CI 2 and 3, the method just calls show_error() with the message 'The action you have requested is not allowed.', though CI3 adds the 403 error code).

In theory, a quick read of the csrf_verify method indicates that it attempts to perform cookie-based CSRF verification for requests which are not POST requests.

Bonfire

Practical CodeIgniter 3
CodeIgniter Testing Guide