title: Disabling CSRF in my web app or a safer approach
body: <p>I'm creating a web app in Laravel, but <code>CSRF</code> is killing its ajax functionality. </p>
  
  <p>The submission of the token with ajax works fine, using <code>ajaxSetup</code> I can attach the token to every request, so no problem with this part. </p>
  
  <p>But every time the user leaves the browser window for too long (perhaps a couple hours or more) ajax requests start returning <code>error 500</code> (token mismatch) - perhaps the server updates the token and the client keeps the old one, forcing the user to refresh the page to keep it functional, something I don't want to do.</p>
  
  <p>So I was thinking of creating some sort of ajax timer to get the updated <code>csrf</code> token from the server every once in a while.. but it seems a bit of a hackish solution, and maybe even useless? (if I'm serving the token, someone can request it and still do a csrf attack, right?)</p>
  
  <p>To solve this issue once and for all, I would have to do something more risky, disabling <code>CSRF</code> completely for ajax calls. My question is: Could this really hurt my security that bad? I've seen many people recommending to turn it off, but it seems like a big deal if someone can cross-request sensitive actions on a user account (such as delete account or something like this)</p>
  
  <p>What would you guys recommend? This issue is keeping me awake a night :/</p>