Question

I have CSRF protection enabled on my site, but the only time the CSRF token is placed in a hidden field is when form_close() is used. I am posting data via ajax and need to send the CSRF as well to prevent the 500 errors.

I thought there was a way to explicitly embed the CSRF token into the page, but I can’t seem to find it.

How can I get the CSRF token when there isn’t a form on the page?

Answer 1

You can get the CSRF token name and value via the security class:

$this->security->get_csrf_hash();
$this->security->get_csrf_token_name();