In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user submits the update, so the CSRF protection works great.
The issue comes when I am using AJAX to submit/load data without a form (such as deleting a status update). In such cases, because there is no form, there is no automatically generated cookie. I have figured out that I can use the cookie that creates the status update to delete it (and have limited the delete function to the status creator).
But does using the status creation cookie to delete the status update violate a security principle? Does the cookie need to expire (or be different than the creation cookie?), and if so, how can I generate another cookie that will be linked to the correct status update?
