We have a site which has a form on it asking for a piece of information (a state, selected from a dropdown - which changes the screens returned). Anonymous users interact with this form.
When we scan this site with Acunetix, it reports that the form does not have CSRF protection. My question is, does it need it? I thought we only needed CSRF tokens for logged-in users, and in cases where the form can modify data on the backend?