CodeIgniter 4 CSRF Protection in AJAX Forms — The Complete Fix

Difficulty: Intermediate | Read time: 12 min | Framework: CodeIgniter 4

Why CSRF Breaks Your AJAX Forms

You build a perfectly working AJAX form. It works fine in testing. Then suddenly — "Page Expired" or a 419 error. You refresh, it works once, then breaks again.

This is CodeIgniter 4's CSRF protection doing its job — but if you don't handle it correctly in AJAX, it will drive you crazy.

In this tutorial I'll show you exactly why it happens and give you production-ready patterns to fix it permanently — for single forms, multiple forms, and even global AJAX setups.