I have gone through the example of CSRF funds transfer from a bank where the user is logged in. Similarly I have looked at CSRF in case of email updating. I think I understood it but I am not quite sure if it extends to unauthenticated requests/ form submissions as well. I am now trying to figure out the impact of CSRF particularly in reference to given below context.
Suppose a shopping website where both authenticated and unauthenticated users can browse and shop. Imagine a scenario where an unauthenticated user browsers and adds a item to his cart(still unauthenticated). He later decides to checkout and is redirected to the checkout page without logging in(access escalated to Guest user from unauthenticated user or something similar).The user now enters his personal information(over SSL) like email, address, telephone, credit card information, etc. His shopping is complete and he closes the application. He is able track/update order using link sent to his email or order number.
Since the user is/might never authenticate in this application, do All forms/requests still need to be protected against CSRF? If not, in what case CSRF protection need to be implemented?
Additionally should searches be be protected against CSRF for logged in vs unauthenticated users? It would be great if you could answer for both. How about comments by visitors (not logged in)?
Are referer checks required even after Tokens are used for CSRF Protection? I don't think so, still making sure.(Not particularly related to above scenario).
How important is Login CSRF for E-commerce websites?
Let me know if I may have missed something here, i am still trying to fully understand CSRF, its impact and associated risks in various scenarios.
P.S. Some scanners throw CSRF at every form submission without random tokens or referer checks.