Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my app (built in Codeigniter), users can submit status updates. When submitting forms, Codeigniter automatically provides a hidden cookie. I can validate that cookie through AJAX when the user submits the update, so the CSRF protection works great.

The issue comes when I am using AJAX to submit/load data without a form (such as deleting a status update). In such cases, because there is no form, there is no automatically generated cookie. I have figured out that I can use the cookie that creates the status update to delete it (and have limited the delete function to the status creator).

But does using the status creation cookie to delete the status update violate a security principle? Does the cookie need to expire (or be different than the creation cookie?), and if so, how can I generate another cookie that will be linked to the correct status update?

share|improve this question
up vote 3 down vote accepted

I think you meant tokens, not cookies. As far as I know, CodeIgniter antiCSRF mechanism inserts unique random tokens in every form. These have nothing to do with HTTP cookies, which as a best practice should not be accessible from JavaScript code.

Regarding your actual question, it has been discussed in other threads if using one anti CSRF token per session is a bad thing (example). Your case is between using one token per form and using one token per session, so as long as you are using SSL you should be ok.

share|improve this answer
Thank you for your response. I have accepted and upvoted your answer. Yes, I am referring to tokens; my question is not related to HTTP cookies at all. I am using one token per form and forcing HTTPS on the site, so it sounds like I should be okay. That said, if anyone knows of helpful resources that discuss use of one CSRF token per form (or session), I'd appreciate a link. – chowwy Jan 11 '13 at 15:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.