CakePHP 4.2 introduced session-based CSRF tokens:
Instead of storing CSRF tokens in a cookie, this middleware stores tokens in the session. This makes CSRF tokens user scoped and time based with the session, offering enhanced security over cookie based CSRF tokens. This middleware is a drop in replacement for the CsrfProtectionMiddleware.
We can consider using this, and then, we no longer need to manually set any CSRF token when doing ajax requests.
CakePHP 4.2 introduced session-based CSRF tokens:
We can consider using this, and then, we no longer need to manually set any CSRF token when doing ajax requests.