# CakePHP 3.5 AJAX and CSRF

**URL:** <https://discourse.cakephp.org/t/cakephp-3-5-ajax-and-csrf/7437>\
**Category:** Need Help\
**Created:** [March 10, 2020, 10:32am UTC](https://discourse.cakephp.org/t/cakephp-3-5-ajax-and-csrf/7437 "2020-03-10T10:32:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![christ57](https://avatars.discourse-cdn.com/v4/letter/c/b4bc9f/32.png) [@christ57](https://discourse.cakephp.org/u/christ57)\
**Post date:** [March 10, 2020, 10:32am UTC](https://discourse.cakephp.org/t/cakephp-3-5-ajax-and-csrf/7437/1 "2020-03-10T10:32:11Z")

</div>

Hello,

I want to update the database using URLs and not a form.

Here is my URL

```
<a href="#" data-action="prive" title="private profil" id="setupprofil" onclick="return false;"><span class="glyphicon glyphicon-remove-circle"></span>&nbsp;private profil</a>

```

Data processing is done using the following script

```
$(document).on('click','#setupprofil',function() {

  var action = $(this).data("action"); // private or public

  console.log($('[name="_csrfToken"]').val()); // Returns correctly the generated CSRF token

  $.ajax({
            url: '/instatux/settings/setup_profil',
            dataType: "text json",
            type: "POST",
            data: {action: action},
            beforeSend: function(xhr) {
        xhr.setRequestHeader('X-CSRF-Token', $('[name="_csrfToken"]').val());
    },

```

When I click on this url to update the database I get the following error message

# ‘\_Token’ was not found in request data.

Is it possible to transmit the CSRF token to the controller by not coming from a form ?

Thank you in advance

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [March 10, 2020, 2:53pm UTC](https://discourse.cakephp.org/t/cakephp-3-5-ajax-and-csrf/7437/2 "2020-03-10T14:53:53Z")

</div>

`_Token` is not the CSRF token, it’s something used by the security component to prevent form tampering.

---

<div class="post-metadata">

**Author:** ![hala0409](https://avatars.discourse-cdn.com/v4/letter/h/f0a364/32.png) [@hala0409](https://discourse.cakephp.org/u/hala0409)\
**Post date:** [December 28, 2020, 10:54am UTC](https://discourse.cakephp.org/t/cakephp-3-5-ajax-and-csrf/7437/3 "2020-12-28T10:54:27Z")

</div>

Hello @christ57,  
When we create a CakePHP form and then based on the input fields the CakePHP generates a hidden field named `_TOKEN`.  
Here is the StackOverflow solution in detail,  
[https://stackoverflow.com/a/51990800](https://stackoverflow.com/a/51990800)