Facing a Forbidden issue

Seeing the code involved will allow people to offer the best advice.

Read the documentation on Cross-site request forgery (CSRF) carefully. That should make clear the need for a hidden csrf <input> field in your forms when using

PHP Code:

$config['csrf_protection'] = TRUE; 


It's important to understand the with this setting...

PHP Code:

$config['csrf_regenerate'] = TRUE; 


The CSRF hash value will change with every POST request to the server. (Only POST, not GET) If your AJAX is a POST then you need to update the hidden CSRF <input> with the new hash value otherwise the next POST will produce the 403 error. One way do the update is have the AJAX response return the new hash and use JavaScript to update the hidden <input>.

Again, show us your code for advice related to your situation.