As I discovered, it seems that "Secure Forms" setting won't allow anyone to submit more than once in Ajax.

I researched about this and I found out that it was because you can't send a form with same XID twice. You need to reload the page to get a fresh XID to submit.

However, this is a problem for Ajaxified forms, simply because of their essential nature and purpose.

Is there an elegant way to use Ajaxified forms inspite of the "Secure Forms" setting being turned on?

2 Answers 2


Yes, you need to get a new XID each time via Ajax and update your form hidden value, so next time the form is submitted it uses the new XID.

Depends what your Ajax is returning of course and where it's submitting to, but in the past on return from the Ajax submission, I've fired another function to just do an Ajax request, then do the replacements.

For example as part of the Ajax Submission function:

request = $.ajax({
    url: $form.attr("action"),
    type: "post",
    data: serializedData

request.done(function (response, textStatus, jqXHR) {
    if (updateForm) {
        AjaxGet(window.location.href, updateHTML);

Then new functions:

//###   Retreave content/pages via Ajax   ###
function AjaxGet(urlString, resultHandler) {
    if (urlString == undefined)
    if (request)

    request = $.ajax({
        url: urlString

    request.done(function (response, textStatus, jqXHR) {

Then the capture:

var updateHTML = function (htmlString) {
    var XID = $(htmlString).find('form#yourID input[name="XID"]').val();
  • Wouldn't it be possible for a user to submit entries faster than the XID can be updated? Aug 13, 2013 at 13:17
  • Depends how you manage the submission, I use: $formElement.prop("disabled", true).addClass("disabled"); to prevent re-submission, then once complete $formElement.prop("disabled", false).removeClass("disabled"); Aug 13, 2013 at 16:25
  • Ok, so if setting secure forms to off is absolutely non-negotiable, then I guess we have to go with this solution. Aug 16, 2013 at 8:52

When I throw an ajax error I use ee()->security->restore_xid() so I can use the same token again. Per http://ellislab.com/expressionengine/user-guide/development/guidelines/security.html#cross-site-request-forgery

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.