[squishi]

I wanted to use the security token to protect an ajax request.
So I submitted the token with the ajax post request from a vbulletin page to my custom page.

<script type="text/javascript"><!--
$(document).ready(function(){

	$("#nudge_icon").click(function(){
		$.ajax({
			url: '/nudge.php',
			type: 'POST',
			async: true,
			dataType: 'text',
			data: ({'from'  : '$bbuserinfo[userid]',
				'to'    : '$userinfo[userid]',
				'securitytoken':'$bbuserinfo[securitytoken]'}),
			success: function(data) {
				alert(data);
			},
			error: function(data) {
				alert(data);
			}
		});
	});

});//-->
</script>

In that custom page (nudge.php), I have included the global.php to load the users details.
And I defined CSRF_PROTECTION as true (don't know if that is even necessary).

I then make a comparison like this:

PHP Code:

if ($vbulletin->userinfo['securitytoken'] != $_POST['securitytoken'])
{
//    echo $vbulletin->userinfo['securitytoken'] ."
//    ". $_REQUEST['securitytoken'];

    exit("error");
} 


This is the part where the script fails. The security tokens never match.
I assume a new token is generated when the global.php is called?

How can I use a securitytoken check on an ajax request?