CSRF Token necessary when using Stateless(= Sessionless) Authentication?
问题 Is it necessary to use CSRF Protection when the application relies on stateless authentication (using something like HMAC)? Example: We\'ve got a single page app (otherwise we have to append the token on each link: <a href=\"...?token=xyz\">...</a> . The user authenticates himself using POST /auth . On successful authentication the server will return some token. The token will be stored via JavaScript in some variable inside the single page app. This token will be used to access restricted