We have a site which has a form on it asking for a piece of information (a state, selected from a dropdown - which changes the screens returned). Anonymous users interact with this form.

When we scan this site with Acunetix, it reports that the form does not have CSRF protection. My question is, does it need it? I thought we only needed CSRF tokens for logged-in users, and in cases where the form can modify data on the backend?


1 Answer 1


No, you don't need CSRF token

Csrf token is used to certify a request is approved by a user. If there is no gain between sending this request by your own and sending this request being another user on the network, Csrf is useless.

  • Thanks for a clear and concise answer! Just what I needed!
    – PeteCon
    Jul 11, 2016 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .