CSRF and caching

Kirby 3
,
1

I’m using a newsletter signup form on every page. In this form there is a hidden input to send the anti csrf token generated by csrf(). The form data is sent via ajax to a custom route to validate the data, check for the token and send a json response.

Unfortunately the pages are not being cache because of the token. Is there any solution to use anti-csrf tokens in combination with page caches? Can I use another route that echoes the token?

Thanks for your help!

2

You could render the form without the token, then make an Ajax call on page load to a route that returns a token and inject it into the csrf form field.