Given the hypothetical situation:
- A user logs into his banking website
- The server returns a Http-only cookie containing the user's id, encrypted.
- On each request (such as when transferring funds), the server decrypts and checks the id.
No CSRF tokens are generated on any of the forms, and request validation is based on the encrypted id.
Is a CSRF attack possible under this scenario? If so, how would it work?