Question
Custom CSRF Token Name Validation for AJAX and Form Requests in CodeIgniter 4
Cig Byte
0 reputation · 28 Apr 2026, 17:44 UTC
82.2K views0
Custom CSRF Token Name Validation for AJAX and Form Requests in CodeIgniter 4
Goal: Configure a custom csrfTokenName in app/Config/Security.php so CodeIgniter 4 validates POST, PUT, PATCH, and DELETE requests consistently whether the token arrives in a hidden form field or an X-CSRF-TOKEN header.
Constraint: The Security middleware appears to prioritize the header when both the header and form field are present, and it rejects requests silently when names do not match the configured value. It is unclear whether customizing csrfTokenName requires updating every AJAX setup individually or whether one middleware-level change covers all request types.
Assumptions: CodeIgniter 4.x with CSRF protection enabled by default. No upgrade from CodeIgniter 3 is involved.
- Does setting csrfTokenName in Security config automatically update both form helper output and AJAX header expectations?
- When both X-CSRF-TOKEN and the custom-named form field are submitted, which value does CI4 validate and can that priority be changed?
- Are custom request types outside the default CSRF method set affected by the token name change?
