title: How to pass a struts2 token via ajax without a form?
body: <p>I am trying to use the <code>token</code> interceptor that ships with Struts in order to implement a CSRF check. However instead of using a <code>&lt;form /&gt;</code> I am making an AJAX call from within some JS:</p>
  
  <p><strong>foo.jsp:</strong>
  </p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;%@ taglib uri="/struts-tags" prefix="s" %&gt;
  &lt;html&gt;
  &lt;body&gt;
      &lt;s:token /&gt;
      &lt;script&gt;
          var strutsToken = "&lt;s:property value="#session['struts.tokens.token']" /&gt;";
      &lt;/script&gt;
      &lt;script src="bar.js"&gt;&lt;/script&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>bar.js:</strong>
  </p>
  
  <pre><code>$.ajax({
      url: '/endpoint',
      data: strutsToken,
      dataType: 'jsonp',
      cache: true,
      success: function() { console.log('success'); },
      error: function() { console.log('failure'); }
  });
  </code></pre>
  
  <p>I've confirmed the token value is making it into the JS variable:</p>
  
  <pre><code>&gt; strutsToken
  "N3ZLLLR2Y3QGMZP0L3UCYWI5CO5NYZEY"
  </code></pre>
  
  <p>Unfortunately when that AJAX request is made an <code>invalid-token</code> error is thrown on the server.</p>
  
  <p>Is what I am attempting to do possible and if so, how?</p>