We have a site which has a form on it asking for a piece of information (a state, selected from a dropdown - which changes the screens returned). Anonymous users interact with this form.

When we scan this site with Acunetix, it reports that the form does not have CSRF protection. My question is, does it need it? I thought we only needed CSRF tokens for logged-in users, and in cases where the form can modify data on the backend?


No, you don't need CSRF token

Csrf token is used to certify a request is approved by a user. If there is no gain between sending this request by your own and sending this request being another user on the network, Csrf is useless.

| improve this answer | |
  • Thanks for a clear and concise answer! Just what I needed! – PeteCon Jul 11 '16 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.