# Create \_Token.fields \_Token.unlocked and \_Topken.debug

**URL:** <https://discourse.cakephp.org/t/create-token-fields-token-unlocked-and-topken-debug/5643>\
**Category:** Need Help\
**Created:** [February 11, 2019, 10:23am UTC](https://discourse.cakephp.org/t/create-token-fields-token-unlocked-and-topken-debug/5643 "2019-02-11T10:23:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![YesNo](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/yesno/32/334_2.png) [@YesNo](https://discourse.cakephp.org/u/YesNo)\
**Post date:** [February 11, 2019, 10:23am UTC](https://discourse.cakephp.org/t/create-token-fields-token-unlocked-and-topken-debug/5643/1 "2019-02-11T10:23:00Z")

</div>

On ajax request with middleware security (CSRF) I would like to set an JSON object with this fields:

\_Token[fields] = hash(fields)  
\_Token[unlocked] = null;  
\_Token[debug] = ???;

My question is how to create \_Token[fields] and \_Token[debug] ? Because I have no form but only a json object when sending data. I have the header with the csrfToken hash!

Thanks a lot for any hint.

Michael

---

<div class="post-metadata">

**Author:** ![dakota](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/dakota/32/1421_2.png) [@dakota](https://discourse.cakephp.org/u/dakota)\
**Post date:** [February 11, 2019, 12:43pm UTC](https://discourse.cakephp.org/t/create-token-fields-token-unlocked-and-topken-debug/5643/2 "2019-02-11T12:43:37Z")

</div>

For ajax json requests you should disable the security component for the target action. Those hashes are built based on a form that is created with the form helper (To prevent form tampering). It doesn’t really work, and isn’t really applicable to ajax/json requests.

---

<div class="post-metadata">

**Author:** ![YesNo](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/yesno/32/334_2.png) [@YesNo](https://discourse.cakephp.org/u/YesNo)\
**Post date:** [February 11, 2019, 2:19pm UTC](https://discourse.cakephp.org/t/create-token-fields-token-unlocked-and-topken-debug/5643/3 "2019-02-11T14:19:09Z")

</div>

thanks a lot. Thats true!

---

<div class="post-metadata">

**Author:** ![saeideng](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@saeideng](https://discourse.cakephp.org/u/saeideng)\
**Post date:** [February 11, 2019, 10:39pm UTC](https://discourse.cakephp.org/t/create-token-fields-token-unlocked-and-topken-debug/5643/4 "2019-02-11T22:39:33Z")

</div>

these fields come from security Components , not CSRF