We are building a 'kiosk' interface into a site powered by EE (2.8.1) which makes various
POST requests to other site templates as part of the flow.
The problem we are having is that because the kiosk needs to be always on, the
csrf_token which is used to authenticate the
POST requests is expiring (after 1 hour currently) and so said requests return a
403 (permission denied).
I had thought that there might be some way to refresh the
csrf_token, but from a bit of research, it seems that these are intrinsically tied to the session's id (something along those lines anyway!), and so the same one is always returned if I post for a refreshed token.
Is there a way that I am missing that would enable us to keep making
POST requests to other site templates and keep CSRF protection enabled?