ajax post csrf problem 403 error

I agree with the idea of returning the regenerated hash with the original ajax call.

I don' t see how it is any more vulnerable than the original page display where anybody with a browser web dev tool can clearly see the token and hash. They'll also be able to see the new hash when the page is updated by the ajax return values.

For more than you wanted to know about CSRF read this.