This question already has an answer here:

I am making a CMS and I have a CSRF protection in settings, new article. Should I also put this protection in the logout ?

marked as duplicate by tim, Neil Smithline, symcbean, John Deters, Stephane Dec 28 '15 at 7:03

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Short answer: yes.

Longer answer: You should have CSRF protection EVERYWHERE where you do something which requires the permission of the current logged in user and is changing some data.

Not the answer you're looking for? Browse other questions tagged or ask your own question.