Version 5.0.0 release

applications/core/modules/front/system/ajax.php

@@ -781,6 +781,9 @@ class ajax extends Controller
 		/* Don't cache the CSRF key */
 		Output::setCacheTime( false );
 
+		/* Restrict endpoint to our origin JS */
+		Output::i()->httpHeaders['Access-Control-Allow-Origin'] = Url::internal('')->data[ Url::COMPONENT_SCHEME ] . '://' . Url::internal('')->data[ Url::COMPONENT_HOST ];
+
 		if ( isset( Request::i()->path ) )
 		{
 			$baseUrlData = parse_url( Url::baseUrl() );
@@ -811,7 +814,8 @@ class ajax extends Controller
 			}
 		}
 
-		Output::i()->json( [ 'key' => Session::i()->csrfKey ] );
+
+		Output::i()->json( [ 'key' => Session::i()->csrfKey, 'expiry' => time() + 500 ] );
 	}
 
 	/**