What is the vulnerability level if the anti-csrf token is not sent with every post request? (If the vulnerability levels were high, medium and low). I understand for critical functions like login etc you would need to include csrf token.
What factors should I consider when deciding whether or not to implement CSRF for each set of permitted requests in a web app?
Update: I found this article here that explains need for csrf token for each request It is interesting that more and more web apps are considering it for each request.