# Invalid security debug token: Froala ajax image upload with CSRF

**URL:** <https://discourse.cakephp.org/t/invalid-security-debug-token-froala-ajax-image-upload-with-csrf/2198>\
**Category:** Need Help\
**Created:** [March 7, 2017, 3:40am UTC](https://discourse.cakephp.org/t/invalid-security-debug-token-froala-ajax-image-upload-with-csrf/2198 "2017-03-07T03:40:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jason001](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/jason001/32/553_2.png) [@jason001](https://discourse.cakephp.org/u/jason001)\
**Post date:** [March 7, 2017, 3:40am UTC](https://discourse.cakephp.org/t/invalid-security-debug-token-froala-ajax-image-upload-with-csrf/2198/1 "2017-03-07T03:40:33Z")

</div>

Hi guys,  
Hoping I can get some help. I’m using froala editor on one of my sites, and I’m trying to get the image uploads to work. It works great on a site once the security and csrf components aren’t enabled. After I enable them, of course my ajax upload action starts complaining about not having the right tokens with my request. After some reading and fiddling around, I found that adding the following to my froala configuration seems to help:

imageUploadParams: {  
’\_Token’: token, // \<- this is $this-\>request-\>param(’\_csrfToken’);  
’\_Token[fields]’: “image”, //\<- not sure what this should be, but hoping to sort it out once I get past this error  
’\_Token[unlocked]’: “image”, //\<- same as above  
’\_Token[debug]’: false //\<- for sure not the right thing to put here  
},

Now when my upload action gets called, the error being thrown is “Invalid security debug token.”. I’ve googled around, but I can’t seem to find a way to get the Debug token. Any ideas?