Does using token-based auth make CSRF checks on login unnecessary?

Question

Based on my understanding, avoiding the use of cookies as an authentication mechanism prevents CSRF vulnerabilities entirely (namely token based authentication in an SPA), when authenticated.

Does this also render CSRF checks on the login page / API endpoint itself unnecessary? As far as I can see, even though we could be tricked into sending requests to it unwittingly, there'd be no effect of this - because we're not using cookies to authenticate on subsequent requests.

However, I wanted to check with your collective wisdom - can we avoid them on the login page? And what about other non-authenticated pages like password resets?

Answer 1

If you treat a request specially because it comes from a particular IP address or includes particular cookies, then there is a potential for CSRF. If no machine-specific information influences how the request is processed, then there is no potential for CSRF. A password reset page could be subject to CSRF if it somehow defaults to the last username used from that machine (i.e. based on cookies, or worse, IP address) and allows the reset to be issued without specifying the username as part of the URL or in POST data. (Still, the damage would be limited since we are just talking about a password reset request.)