# Slim CSRF Protection Route

**URL:** <https://discourse.slimframework.com/t/slim-csrf-protection-route/3114>\
**Category:** Questions\
**Created:** [April 25, 2019, 10:45am UTC](https://discourse.slimframework.com/t/slim-csrf-protection-route/3114 "2019-04-25T10:45:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elvisreis](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/elvisreis/32/1298_2.png) [@elvisreis](https://discourse.slimframework.com/u/elvisreis)\
**Post date:** [April 25, 2019, 10:45am UTC](https://discourse.slimframework.com/t/slim-csrf-protection-route/3114/1 "2019-04-25T10:45:12Z")

</div>

I have a route that gets a json body sent by a javascript code

I would like to mount a json post body with the csrf protection.

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [April 25, 2019, 7:16pm UTC](https://discourse.slimframework.com/t/slim-csrf-protection-route/3114/2 "2019-04-25T19:16:45Z")

</div>

> [@elvisreis](#):
>
> csrf protection.

[http://www.slimframework.com/docs/v3/features/csrf.html](http://www.slimframework.com/docs/v3/features/csrf.html)

---

<div class="post-metadata">

**Author:** ![elvisreis](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/elvisreis/32/1298_2.png) [@elvisreis](https://discourse.slimframework.com/u/elvisreis)\
**Post date:** [April 25, 2019, 7:32pm UTC](https://discourse.slimframework.com/t/slim-csrf-protection-route/3114/3 "2019-04-25T19:32:25Z")

</div>

This way I managed with a form via post, I have difficulty validating CSRF when I send a post with the message body in json via javascript where I get the form data and transform into a json

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [April 26, 2019, 8:28am UTC](https://discourse.slimframework.com/t/slim-csrf-protection-route/3114/4 "2019-04-26T08:28:54Z")

</div>

True, I’ve had the same issue.

Unfortunately, a transfer of the token in the HTTP header is not supported in this library. \*[PR](https://github.com/slimphp/Slim-Csrf/pull/98)