CSRF attack detected when submitting data using ajax

Question

I'm trying to submit a form using jquery in symfony 1.4, but CSRF attack detected error pops up each time. This is the code i use to submit the form data:

$.ajax({
      type: 'post',
      cache: false,
      url: $('#assign-form form').attr('action'),
      data: (
        'activity[id]=' + $('#activity_id').val() +
        '&activity[_csrf_token]=' + $('#activity__csrf_token').val() +
        '&activity[assigned_to_user_id]=' + $('#activity_assigned_to_user_id').val() +
        '&activity[assigned_to_group_id]=' + $('#activity_assigned_to_group_id').val()
      )
});

Am i missing something?

Thanks, Radu.

Answer 1

One thing to look at is whether the Form object that is validating the input is the exact same class as the the one that generated the token. By default, the class is used in the generation of the CSRF token.

If, for example, you had an instance of a subclass of a form used to generate the form html and then you posted to an action that used the ancestor form class, the validation would most likely fail by default.

It's possible to override the token creation if it turns out this is your issue.

Also, have you verified that the value of the token field actually includes a token? A console.log() may help you discover this.

Um...as I look closer at your code, another thing to look at is that you're building a query string to pass in 'data'. Have you tried passing an actual JSON-style object instead?