CSRF error in Ajax POST request

[Jawfin]

This doesn’t answer your question directly, but instead it shows a working solution of using AJAX with CakePHP 4 and CSRF and as a bonus the form tampering protection too: -

Working CSRF AJAX in CakePHP 4 - looking for criticism!

This is a complete build of a running AJAX using CakePHP4 with CSRF and Form Tampering protection. It reverses a user entered string. Create the ajax project: - composer self-update && composer create-project --prefer-dist cakephp/app:4.* ajax Edit config/app_local.php ... 'username' => 'root', 'password' => 'secret', 'database' => 'cake_ajax', ... Or whatever your database is. For this demonstration I am using this table: - DROP TABLE IF EXISTS `myajax`; CREATE TABLE `myajax` ( …

In there it doesn’t access the token directly from getParam(), but uses the CakePHP form creator to populate the hidden field it uses for passing the token (so its in the form, not the header). It may help.