In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user submits the update, so the CSRF protection works great.

The issue comes when I am using AJAX to submit/load data without a form (such as deleting a status update). In such cases, because there is no form, there is no automatically generated cookie. I have figured out that I can use the cookie that creates the status update to delete it (and have limited the delete function to the status creator).

But does using the status creation cookie to delete the status update violate a security principle? Does the cookie need to expire (or be different than the creation cookie?), and if so, how can I generate another cookie that will be linked to the correct status update?

1 Answer 1


I think you meant tokens, not cookies. As far as I know, CodeIgniter antiCSRF mechanism inserts unique random tokens in every form. These have nothing to do with HTTP cookies, which as a best practice should not be accessible from JavaScript code.

Regarding your actual question, it has been discussed in other threads if using one anti CSRF token per session is a bad thing (example). Your case is between using one token per form and using one token per session, so as long as you are using SSL you should be ok.

  • 1
    Thank you for your response. I have accepted and upvoted your answer. Yes, I am referring to tokens; my question is not related to HTTP cookies at all. I am using one token per form and forcing HTTPS on the site, so it sounds like I should be okay. That said, if anyone knows of helpful resources that discuss use of one CSRF token per form (or session), I'd appreciate a link.
    – chowwy
    Jan 11, 2013 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .