CSRF token mismatch in post request in 3.6 version - cakephp

Question

I have two different apps of cakephp. One has a version 3.5 and other 3.6.
When i used and built 3.5 app i did not have a problem of CSRF matching in post request. But now as i am using 3.6 it is giving me error of CSRF token.
Although in both app's AppController, CSRF component is disable.
//$this->loadComponent('Csrf');
i am using simple post request like this:
$.ajax({
type: "POST",
url: "../user/my_action",
dataType: 'json',
success: function (data) {
set_data(data.response);
}
});
What am i missing? or some configuration i have done wrong?

Answer 1

The latest 3.6 application template now uses the CSRF middleware by default, see your apps src/Application.php file. Unfortunately this change hasn't been documented properly, and hit people by surprise.
Ideally you do not disable it, but instead pass the proper CSRF token alongside with your AJAX requests, you can easily obtain the token from the request object in your view templates, for example in the layout to make it globally available:
<script>
var csrfToken = <?= json_encode($this->request->getParam('_csrfToken')) ?>;
// ...
</script>
You can then easily use it in your AJAX requests:
$.ajax({
headers: {
'X-CSRF-Token': csrfToken
},
// ...
});
See also
Cookbook > Middleware > Cross Site Request Forgery (CSRF) Middleware
Cookbook > Middleware > CSRF Protection and AJAX Requests

Answer 2

Add this code on your $.ajax() function call:
beforeSend: function (xhr) { // Add this line
xhr.setRequestHeader('X-CSRF-Token', $('[name="_csrfToken"]').val());
}, // Add this line

Answer 3

For CakePHP 3.8, this worked for me. In config\routes.php
comment the line as so :
//$routes->applyMiddleware('csrf');

Answer 4

i had the same error, without using ajax, the problem was that admin theme was not using cakephp 3 form helper sintax, it was html.
after i changed with Form->create() ?> Form->end() ?> it worked fine