I'm trying to figure out if I completely understand CSRF security properly. Based on:
In all scenarios it seems like your frontend has to have the CSRF token somewhere so that when a request is sent to the backend, it can compare both the csrf token in the cookie/session to the request. That way when an attacker tries to create a request on behalf of a logged in user, since they don't have the token in the request, it won't be validated.
This means in order for CSRF implementation you need to configure both front and backend.
Now let's say I want all the CSRF security to be done on the backend is this possible, not changing frontend?
Also if my frontend application is separated from backend, do I still need to be worried about CSRF attacks?