Do I need to protect against cross-site request forgery if my form is submitted by Ajax?

Question

PHP

Delivered a plug-in from cross-site requests. It generates a token in the form. Everything is working. But I have a form sent by ajax. The problem is that the plugin does not work with it, since it generates tokens once when the page is loaded, respectively, it will work only on the first send, when resubmitted from this page, the plugin will not work because new tokens will not be generated. What to do?

Answer 1

yes, you need to do
this before sending a new response, generate a token using the same means and send it and display it on the client