ajax - Rails authenticity token (CSRF) provided but being refused -

i'm sending ajax request rails site (to go javascript controller). rails refuses allow post unless supply authenticity token, added 1 using

<%= csrf_meta_tags %>  

and

var auth_token = "<%=j form_authenticity_token %>" 

and fine. however, new customer installed plugin accesses site , triggers ajax in first place. 1 customer--the authenticity token denied, despite being supplied (i checked in logs.)

i realize i'm not giving lot of clues go off of, cause authenticity token accepted in 1 situation , denied in another? more broadly, how authenticity_token generated anyways--a new 1 every single time page loaded?

rails assigns cryptographically random csrf token the user session.

the server compares value submitted authenticity_token parameter value associated user’s session.

one thing need careful if using fragment caching (which speeds rendering caching chunks of view) need ensure <%= csrf_meta_tags %> not cached since stale csrf meta tag lead mismatch token stored in session.

when posting ajax, need forward csrf token x-csrf-token header.

var promise = $.ajax({      url: '/example',     type: 'post',     beforesend: function(xhr) {          xhr.setrequestheader('x-csrf-token',          $('meta[name="csrf-token"]').attr('content'))      },     data: 'somedata=' + somedata });