CSRF and double posting

It's been a while since I've looked at it, but it was my understanding that the CSRF token is not always regenerated, and one such case would be during an AJAX request ( or at least that was the way it used to work ). I never liked the way CI handles the CSRF token, so I created my own Tokens library. My first version of that library ensured a new token on each request, but then I found that to be problematic, because a person could not have two browser tabs open without running into problems. So the latest version uses an array of tokens, and only subtracts one when it is used. This has been working great for me on my websites.

I do think that the double submission issue is directly related to form tokens. CI chooses to call it a "CSRF token", but it is a common use to use them to ensure that duplicate submissions are not allowed.

Lastly, in my own forms, if AJAX requests are being made, I often will disable the form buttons until I get a response, but also show a network activity indicator (image) so that people don't think that nothing is happening.

Expert Website Development - Temecula, CA
Community Auth For CodeIgniter 3