General recommendation is to include an anti-forgery token in all POST requests, but is it needed for email newsletter subscription form?
Many single page scrolling sites have email subscription form on page, and using anti-forgery token may have performance implications since anti-forgery token and caching doesn't work well together.
It depends.
You only need protection against CSRF for endpoints that are protected with some sort of authentication. The reason that the attacker needs to fool the victims browser into sending the request (i.e. to "forge" it) is that the attacker doesn't know the session cookie, so she can't just send it from her own machine.
So for an ordinary newsletter form, where theres not authentication and you just enter your email address and hit submit, you don't need CSRF protection. If I want to sign you up against your will I just enter your email and do it myself.
However, if the form is behind authentication and perhaps the email address is fetched from the user database, then it's a different story.
