Question: how csrf works in codeigniter?
Answer: The CSRF token is added to the form as a hidden input only when the form_open() function is used. A cookie with the CSRF token's value is created by the Security class, and regenerated if necessary for each request. If $_POST data exists, the cookie is automatically validated by the Input class.