I have a main website with an email subscription form. And my other websites where I have an email capture form. A user enters their email on those website and via POST he's redirected to the main website where an email he's entered is already pre-populad in a subscription form and where a user now has to click "Confirm to subscribe".
Is this correct that there's little to no risk of getting attacked by CSRF? At the moment there's no authentication for users. In the future there it may or may not be added.
When CSRF protection is turned on on my main website, all requests, of course, from my child websites to subscribe get rejected. Is this a correct behaviour and is there one details missing to make them come through?
Or should I turn CSRF protection off and is this how it usually is on other websites out there with the same functionality?