Csrf_hash should it be public?

Question

CodeIgniter

The essence of the question is this: there is a project on codeigniter, in it on the front I found the following line

<script type="text/javascript">
            var token = '<?php _e( $this->security->get_csrf_hash() )?>',
                PATH  = '<?php _e(PATH)?>',
                BASE  = '<?php _e(BASE)?>';
        </script>

when I go to the site, I see this token open in the inspector. I.e :

<script type="text/javascript">
            var token = 'fb87626bab9ac6ad4e76f87fd376555',
                PATH  = 'https://123.global/',
                BASE  = 'https://123.global/';
        </script>

Is it supposed to be like this or am I missing something?

Answer 1

Yes, that's how it should be. And yes, you do not understand why these tokens are needed and how it works .