2
I checked and I can see the XID param being sent to the jquery.ajax by looking in chrome network panel, i can see the query string it builds. So we are good there.
It sounds like you are sending the XID in GET instead of POST data. CSRF tokens must be present in the POST data if POST data is received by ExpressionEngine.
2.7.3:
POST: XID
2.8+:
POST: ...
1
This is likely due to parse order, where the {csrf_token} variable wouldn't be parsed yet until the {exp:freeform:form} tag has fully rendered, which would be after the parameters have been parsed.
1
ExpressionEngine 2.9.3 officially addressed and resolved some common issues with CSRF. I strongly suggest you upgrade to EE 2.9.3 or greater to resolve or rule out that issue. :)
"CSRF tokens stored in cookies refresh with page refresh." - ExpressionEngine 2.9.3 Change Log
1
csrf_token has been introduced in EE 2.8+. See http://www.solspace.com/docs/super_search/search/#csrf_token
EE 2.7.x used XID before it was renamed to csrf_token. Therefore, you need to add an XID hash instead if you're on EE 2.7.x:
<input type="hidden" name="XID" value="{XID_HASH}" />
1
I just tested this (really quickly) on one of my sites running 2.8.1 and couldn't exploit the exp_csrf cookie in the way described by your report.
However I could do it on your site using the exact same method. So perhaps a simple update to 2.8.1 or higher will fix the problem for you.
UPDATE (from my comment)
The site I tested on had no search form, ...
Only top voted, non community-wiki answers of a minimum length are eligible