title: Is exposing a session's CSRF-protection token safe?
body: <p>Django comes with <a href="https://github.com/brosner/django-csrf/blob/master/django_csrf/middleware.py" rel="noreferrer">CSRF protection middleware</a>, which generates a unique per-session token for use in forms. It scans all incoming <code>POST</code> requests for the correct token, and rejects the request if the token is missing or invalid.</p>
  
  <p>I'd like to use AJAX for some POST requests, but said requests don't have the CSRF token availabnle. The pages have no <code>&lt;form&gt;</code> elements to hook into and I'd rather not muddy up the markup inserting the token as a hidden value. I figure a good way to do this is to expose a vew like <code>/get-csrf-token/</code> to return the user's token, relying on browser's cross-site scripting rules to prevent hostile sites from requesting it.</p>
  
  <p>Is this a good idea? Are there better ways to protect against CSRF attacks while still allowing AJAX requests?</p>