This is probably really simple but it isn’t obvious to me right now why this isn’t working.
I am setting a session variable on the index.php file, putting the value into a hidden field within a form and then submitting the form via jQuery and ajax. All the other form data is there and the hidden input value is there. But if I just try to echo the actual session variable out I get nothing eg:
$response['message'] = $_SESSION['csrf_token']; // no output
$response['message'] = $_POST['token']; // outputs the session variable value stored in the hidden field
On index.php
<?php
session_start();
$_SESSION['csrf_token'] = uniqid('', true);
?>
<input type="hidden" name="token" value="<?php echo $_SESSION['csrf_token']; ?>">
jQuery:
var form = $('#testForm').serialize();
$.ajax({
url: 'test',
type: 'POST',
dataType: 'json',
data: form,
beforeSend: function() {
// loading spinner etc.
}
})
You just need to make sure the session has started on each script.
session_start();
$response['message'] = $_SESSION['csrf_token'];
$response['message'] = $_POST['token'];