Why bother requiring CSRF token on POST requests?

Question

My understanding is that CSRF prevents an attacker using an tag to get the victim\'s browser to send a request that would be authenticated using the

Answer 1

Having done some further investigation:

It's possible for the attacker to host a

on their own site which submits to the target site (your site). All they need to do is get the victim to submit this form and it'll be submitted with their cookies and potentially their authentication.

It's also possible for the attacker to inject an