What is the vulnerability level if the anti-csrf token is not sent with every post request? (If the vulnerability levels were high, medium and low). I understand for critical functions like login etc you would need to include csrf token.

What factors should I consider when deciding whether or not to implement CSRF for each set of permitted requests in a web app?

Update: I found this article here that explains need for csrf token for each request It is interesting that more and more web apps are considering it for each request.

  • What is the disadvantage of requiring the token for each request?
    – lzam
    Commented Aug 27, 2014 at 23:09

2 Answers 2


If the POST changes state on the server then not including a csrf token leaves you vulnerable. The level of risk depends upon the specific functionality served at that URL if the attacker abuses it with a csrf attack.


CSRF token should be part of a layered approach. You may employ other techniques or other checks on session (CAPTCHA, require logon, out of band confirmation, etc.).

The cost to include a CSRF token is generally low, especially if you are working with a framework that can include it for you automatically. There are few cases where you will run into user compatibility issues (especially in normal human using a browser cases) You may want to think about cases where you explicitly do not want to use CSRF.

For example, cases where perhaps you want requests to be initiated directly. e.g., if you offer a search box on your site and require a CSRF token, it may make it impossible to create a quick search in the user's browser url bar.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .