I'm working on a PHP website based entirely on AJAX (via jQuery). It's a single page in which all requests are made by AJAX.
Related to the protection against CSRF I have encountered the problem of having to manually include the token on every request I make, which is extremely tedious and uncomfortable. Looking for an alternative solution to tokens, I read about SOP (Same Origin Policy) in relation to AJAX requests. If I understood it well, xmlhttprequest is not allowed across different domains (unless this enabled CORS, which is not the case).
So, in this case, I'm wondering if checking the origin of the request (through HTTP_ORIGIN) and the header X-Requested-With (to ensure the request is an AJAX request), would be enough in order to prevent CSRF attacks. i.e, I wanted to know if there is any token really needed considering the above conditions.
Thanks so much for your time.