javascript - Disabling CSRF in my web app or a safer approach -

i'm creating web app in laravel, csrf killing ajax functionality.

the submission of token ajax works fine, using ajaxsetup can attach token every request, no problem part.

but every time user leaves browser window long (perhaps couple hours or more) ajax requests start returning error 500 (token mismatch) - perhaps server updates token , client keeps old one, forcing user refresh page keep functional, don't want do.

so thinking of creating sort of ajax timer updated csrf token server every once in while.. seems bit of hackish solution, , maybe useless? (if i'm serving token, can request , still csrf attack, right?)

to solve issue once , all, have more risky, disabling csrf ajax calls. question is: hurt security bad? i've seen many people recommending turn off, seems big deal if can cross-request sensitive actions on user account (such delete account or this)

what guys recommend? issue keeping me awake night :/

i have on option in mind now...

you can start looking @ cors configurations on application.

changing access-control-allow-origin headers few routes. reference