Question

Here is how I add the csrf to the form

$this->addElement('hash', 'csrf', array('ignore' => false));

When this happens the session is created, Then when the user sends an ajax request, the values in the request are validated by creating an instance of the form, and the form is always valid for the first ajax request since the beginning of initial request which created the html output,

When the ajax request has been sent for the second time something different happens,

That instance of the form has a different csrf value than the originally made one, and when my code is done, the originally created session is destroyed as well, so there is no session to check the received the values against, and hence the form doesn’t validated and the following error occurs.

No token was provided to match against

Any ideas at which event, the csrf values of the form are automatically stored in the session?

Answer 1

The hash value is generated at render time and invalidated after the each request.

If you want to continue using Zend_Form_Element_Hash in your AJAX form where the form may submit several times, your AJAX response should include the new hash value. Upon receiving the response, you should update the form data.