ExpressionEngine 2.8.1 always gives 403 Forbidden error when using ajax

Question

ExpressionEngine 2.8.1 always gives 403 Forbidden error when using ajax. Every ajax call given "This form has expired. Please refresh and try again." response.

I have also tried to pass hidden XID

<input type="hidden" name="XID" value="{XID_HASH}" />

and made secure form's value 'n' in config file.

Anybody have solution, how can i fix it

Thanks

Answer 1

ExpressionEngine has a protection against Cross-site Request Forgery - CSRF and a documentation available here. You just have to add that line to your form:

<input type="hidden" name="csrf_token" value="{csrf_token}">

And send the data in your AJAX request. I had the same problem today and that fixed it for me.

Answer 2

I wouldn't recommend this but in cases where you have no choice, e.g. you cannot tweak the code in an app in time or something to that effect, you can opt to conditionally disable secure forms in your config.php or bootstrap.

E.g.

// Make an exception to make AJAX forms app-compatible
// EE 2.7.x introduced mandatory XIDs even for AJAX, but an app won't have an initial valid XID to begin with
if (substr($_SERVER['REQUEST_URI'], 0, 13) == '/app/post/url')
{
  //$config['secure_forms'] = 'n'; // Deprecated and obsolete in EE 2.8
  $config['disable_csrf_protection'] = 'y'; // Introduced in EE 2.8, XID replaced by csrf_token
}