CSRF only on POST request, reason?

The CSRF is stored in a cookie, however, CI only validate that cookie against POST requests. If the request is anything but POST, it just generate a new CSRF cookie.

CI_Class -> csrf_verify() line 208

PHP Code:

// If it's not a POST request we will set the CSRF cookie
if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST')
{
   return $this->csrf_set_cookie();
} 


Oops, you're right. I was reading that too quickly and apparently missed the return part.

Bonfire

Practical CodeIgniter 3
CodeIgniter Testing Guide