@Zachiel If your anti-CSRF implementation uses the token synchronizer pattern, and you're legitimately loading a page with a form and then submitting it, you do.

@Xander I fear I'm still too bad at security to understand everything you said. I am loading a joomla page that hase a form in it, but the php I'm calling with ajax is not inside the _JEXEC chain. Is this "legitimate"?