Getting 403 on AJAX POST to controller

I wrote incorrect thing. PHP can handle multipart/form-data POST data as $_POST.

An associative array of variables passed to the current script via the HTTP POST method when using application/x-www-form-urlencoded or multipart/form-data as the HTTP Content-Type in the request.
https://www.php.net/manual/en/reserved.v...s.post.php

But $_POST does not have JSON request data.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

OK, so this is a follow-up of sorts.

If I submit the form once via ajax, it's processed by my controller (CI's CSRF check passes).

If I submit the form again, without re-loading anything, it's not processed by my controller (CI's CSRF check fails, I'm guessing). The submitted data is identical.

In Security.php I have $tokenRandomize = true, $expires = 7200, and $regenerate = false. So I don't understand why CI wouldn't accept it on the second submission since nothing has changed.

-joho

When I encountered this problem, I took the easy way out and just turned off CSRF for the routes. This done by editing the $globals array in Config/Filters.php.

PHP Code:

public $globals = [
        'before' => [
            // turn off use of csrf for ajax calls
            'csrf' => [
                'except' => ['/ecco/publications/checkDoi', '/salinity/publications/checkDoi' ]
            ],
        ], 


In my application I have data input forms where I want to check one field for duplicates and provide links to view any duplicates found.  It's old data so there could be more than one existing record with the same DOI value.

Thank you for the suggestion! That would, of course, work for me too; had I not been concerned about the security implications.

But I am still confused as to why it seems like CI wants a different token value on the next request, since I set the regenerate-setting to false.

-joho

But I am still confused as to why it seems like CI wants a different token value on the next request, since I set the regenerate-setting to false.

In my understanding, CI does not want a different token value on the next request
with your configuration.

Are you sure your config is truly applied?

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

Well, something is causing the 403, and it happens before my code is executed.

No, I'm not sure the regeneration is disabled, but how would I best test that?

-joho