Body: <p>I've got a Craft plugin that returns some results based on filter options on the front end. The filter sends an ajax submissions and returns the markup to populate the front end with.</p>
  
  <p>I've read <a href="https://craftcms.com/support/csrf-protection#updating-your-javascript" rel="nofollow noreferrer">the docs on CSRF protection</a> and specifically implemented what it says for jQuery based post submissions. However I'm still getting a 400 error saying "<strong>Bad Request - The CSRF token could not be verified.</strong>" for every post request. </p>
  
  <p><a href="https://i.sstatic.net/GkDXm.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/GkDXm.jpg" alt="CSRF &amp; 400 error"></a></p>
  
  <p>You can see a token is being sent in the post data.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-11-29T21:33:51.310Z
Comments.Text: Does this solve the problem? http://craftcms.stackexchange.com/questions/6580/how-can-i-use-csrf-protection-with-ajax-routes
Comments.UserDisplayName: Lindsey D
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-11-29T21:57:53.537Z
Comments.Text: Hi Lindsey. Thanks for the link but no that's what I'm already doing (hence linking to that in the docs and showing the token is in the post data being send to the plugin action).
Comments.UserDisplayName: JamesNZ
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-11-30T00:32:58.273Z
Comments.Text: Is there any caching involved here?  My guess would be you're sending a token, but it's an old token....
Comments.UserDisplayName: Jeremy Daalder
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-11-30T01:37:41.490Z
Comments.Text: Hey Jeremy. No caching at this point. The token is generated on page load, then is used whenever the user interacts with the filters (meaning multiple submissions). I'm not sure if that is an issue? It doesn't work on the first one either though.
Comments.UserDisplayName: JamesNZ
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-11-30T02:23:19.707Z
Comments.Text: Hmm, no - I just double checked but two add to carts in a row can use the same token (it's tied to the session I guess).  I am pretty sure I have seen CSRF being raised as an issue when the error was something else.  I presume you've turned off CSRF and made sure all is working without it?
Comments.UserDisplayName: Jeremy Daalder
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-05-08T17:59:07.927Z
Comments.Text: I'm having this same problem right now, ever figure out the issue?
Comments.UserDisplayName: Rick Kukiela
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-05-09T04:18:51.503Z
Comments.Text: Sorry Rick. I have since got past the issue but am unsure what happened. I'm trying to replicate this again for you.
Comments.UserDisplayName: JamesNZ
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-05-09T04:24:40.437Z
Comments.Text: Hey Rick - I can't see anything relevant that changed from a code point of view since this date. Perhaps in shifting databases between environments messed it up for me. Try clearing your compiled templates (or probably all your caches) and let us know if that helps.
Comments.UserDisplayName: JamesNZ
Tags: <plugin-development><ajax><csrf>
Title: CSRF token could not be verified - ajax
ThreadText: # CSRF token could not be verified - ajax
  
  (Asked by: username_0 on 2016-11-29)
  
  I've got a Craft plugin that returns some results based on filter options on the front end. The filter sends an ajax submissions and returns the markup to populate the front end with.
  
  I've read [the docs on CSRF protection](https://craftcms.com/support/csrf-protection#updating-your-javascript) and specifically implemented what it says for jQuery based post submissions. However I'm still getting a 400 error saying "**Bad Request - The CSRF token could not be verified.**" for every post request.
  
  [![CSRF & 400 error](https://i.sstatic.net/GkDXm.jpg)](https://i.sstatic.net/GkDXm.jpg)
  
  You can see a token is being sent in the post data.
  
  **Tags:** plugin-development, ajax, csrf
  
  > **Comments:**
  > **username_1**: Does this solve the problem? http://craftcms.stackexchange.com/questions/6580/how-can-i-use-csrf-protection-with-ajax-routes  
  > **username_0**: Hi username_1. Thanks for the link but no that's what I'm already doing (hence linking to that in the docs and showing the token is in the post data being send to the plugin action).  
  > **username_2**: Is there any caching involved here?  My guess would be you're sending a token, but it's an old token....  
  > **username_0**: Hey username_2. No caching at this point. The token is generated on page load, then is used whenever the user interacts with the filters (meaning multiple submissions). I'm not sure if that is an issue? It doesn't work on the first one either though.  
  > **username_2**: Hmm, no - I just double checked but two add to carts in a row can use the same token (it's tied to the session I guess).  I am pretty sure I have seen CSRF being raised as an issue when the error was something else.  I presume you've turned off CSRF and made sure all is working without it?  
  > **username_3**: I'm having this same problem right now, ever figure out the issue?  
  > **username_0**: Sorry username_3. I have since got past the issue but am unsure what happened. I'm trying to replicate this again for you.  
  > **username_0**: Hey username_3 - I can't see anything relevant that changed from a code point of view since this date. Perhaps in shifting databases between environments messed it up for me. Try clearing your compiled templates (or probably all your caches) and let us know if that helps.  
  
  ---
  
  ## 0 answers
  
  