By default, I have CSRF protection for all my forms using a token.
However I noticed another web application that has a similar function to one of my forms. ANd they did not use CSRF token.
So I assumed they did not protect against CSRF attack for that form.
question 1) other than CSRF token, there should not be another way to protect against CSRF right?
I am assuming the answer is this is the only way. hence my main question is
question 2) when should you not use CSRF protection?
I know one possible instance which is when the POST form is targeted at external URLs.
I read it at django docs.
Are there other instances when you should not use CSRF protection or unnecessary?
a) other methods of CSRF protection include user re-authentication
b) you CAN get away without protecting against CSRF for form POSTBACKs when you do not require the user to be logged in. (see nbnh's answers and comments)