# CSRF error in Ajax POST request

**URL:** <https://discourse.cakephp.org/t/csrf-error-in-ajax-post-request/8626>\
**Category:** Need Help\
**Created:** [November 17, 2020, 11:56am UTC](https://discourse.cakephp.org/t/csrf-error-in-ajax-post-request/8626 "2020-11-17T11:56:07Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Jawfin](https://avatars.discourse-cdn.com/v4/letter/j/dbc845/32.png) [@Jawfin](https://discourse.cakephp.org/u/Jawfin)\
**Post date:** [November 17, 2020, 8:49pm UTC](https://discourse.cakephp.org/t/csrf-error-in-ajax-post-request/8626/4 "2020-11-17T20:49:56Z")

</div>

This doesn’t answer your question directly, but instead it shows a working solution of using AJAX with CakePHP 4 and CSRF and as a bonus the form tampering protection too: -

> [@Working CSRF AJAX in CakePHP 4 - looking for criticism!](https://discourse.cakephp.org/t/working-csrf-ajax-in-cakephp-4-looking-for-criticism/7714/5):
>
> This is a complete build of a running AJAX using CakePHP4 with CSRF and Form Tampering protection. It reverses a user entered string. Create the ajax project: - composer self-update && composer create-project --prefer-dist cakephp/app:4.\* ajax Edit config/app\_local.php ... 'username' =\> 'root', 'password' =\> 'secret', 'database' =\> 'cake\_ajax', ... Or whatever your database is. For this demonstration I am using this table: - DROP TABLE IF EXISTS `myajax`; CREATE TABLE `myajax` ( …

In there it doesn’t access the token directly from `getParam()`, but uses the CakePHP form creator to populate the hidden field it uses for passing the token (so its in the form, not the header). It may help.

---

_[View the full topic](https://discourse.cakephp.org/t/csrf-error-in-ajax-post-request/8626)._