CSRF and double posting

blah blah blah

What does the "A" stand for in AJAX? If you're making synchronous AJAX calls you've failed on so many levels I don't even know where to begin. I'd love to see how you manage concurrent AJAX requests with this enabled since CI's implementation uses a single valid token. I'm astounded I even had to say asynchronous as only a complete moron would send synchronous AJAX calls. The spec is even deprecating this behaviour and for good reason. Let's lock browser threads! Yay!

If you aren't vulnerable to XSS attacks, can you provide an example of a security hole created by using a single token vs a token that changes per request? I'd love to hear it because apparently the security company we paid to smash away at our app for 3 days straight wasn't able to find one.

And please, don't say "in theory if they get your token"... if they can steal it once they can steal it 100 times.