CSRF 403 errors across AJAX filters, modal data loading, and record deletions

Support
1

Hi everyone,

I’m running InvoicePlane v1.7.2 on PHP 8.3 with CSRF enabled in ipconfig.php :

  • CSRF_PROTECTION=true
  • CSRF_REGENERATE=false

Throughout normal use, multiple core operations fail with 403 Forbidden (“The action you have requested is not allowed” ):

  1. AJAX Filtering & Lookups: Dynamic table filtering and autocomplete/AJAX calls (filter/ajax/* , invoices/ajax/* , quotes/ajax/* ).
  2. Deletions across modules: Deleting draft invoices, quotes, clients, or payments from list view modals (invoices/delete/* , quotes/delete/* , payments/delete/* , clients/delete/* ).

Currently, the application only functions without throwing 403 errors if I either disable CSRF completely via CSRF_PROTECTION=false , or add a wide list of exceptions to config.php :

PHP$config['csrf_exclude_uris'] = array( 'filter/ajax/.*', 'invoices/ajax/.*', 'quotes/ajax/.*', 'invoices/delete', 'invoices/delete/.*', 'quotes/delete', 'quotes/delete/.*', 'payments/delete', 'payments/delete/.*', 'clients/delete', 'clients/delete/.*', );

Since the templates already include <?php _csrf_field(); ?> , it appears CodeIgniter’s CSRF token in the cookie frequently falls out of sync with AJAX calls and modal payloads.

Is there a standard global fix or core patch to keep CSRF enabled across all these modules without having to maintain an extensive whitelist in csrf_exclude_uris ?

Thanks!