Csrf令牌仅在第一次使用ajax提交时有效

Question

i want to submit my form using jquery ajax, it is ok but just for first time i click submit, here is my code.

    <!-- input code from the form -->
    <input type="hidden" name="<?php echo $this->security->get_csrf_token_name(); ?>" value="<?php echo $this->security->get_csrf_hash(); ?>" />

    <!-- js code -->
    $.ajax({
        url: ajaxurls.ask,
        type: 'POST',
        data: formData,
        contentType: false,       // The content type used when sending data to the server.
        cache: false,             // To unable request pages to be cached
        processData:false, 
        success: function (html) {
            var data = jQuery.parseJSON(html);
            if(data.status == 'ok') {
                $('.row_question_form').after(data.response.html);
                $('.question_' + data.response.question[0].question_id).hide().fadeIn();
                $('#question_form').val('');
                $('#thumbnails').empty();
                $('#ask_question_messages').empty();
                $('#ask_question_messages').html(data.message);
            }else if(data.status == 'error'){
                $('#ask_question_messages').empty();
                $('#ask_question_messages').html(data.message);
            }
        }
  });

You would probably say to set $config['csrf_regenerate'] = FALSE; but in this case someone could create hundred of records in my database with a application like this:

http://i.imgur.com/qA4pqyr.png

Answer 1

It is correct that you can only submit one POST per CSRF Token, as they are for one-time use.

If your intention is to alter serverside data, POST is the correct method.

But if you are trying to just read data from server, you should use GET method.

This is nicely explained here.

---

If you want to disable CSRF renewal because it would not be necessary to generate a new token per request you can do it in CI v3.0 by setting the configuration:

$config['csrf_regenerate'] = FALSE;

---

If you, on the other hand, prefer to get a new token and refresh your form for a new submission, read this howto.