title: Why bother requiring CSRF token on POST requests?
body: <p>My understanding is that CSRF prevents an attacker using an <code>&lt;img&gt;</code> tag to get the victim's browser to send a request that would be authenticated using the session cookie. Given that <code>&lt;img&gt;</code>s are always submitted using a GET request, not POST, then why is it necessary to require a CSRF token in a POST request?</p>
  
  <p>Also, the attacker wouldn't be able to submit a form in the webpage without being able to run code (ie. an XSS attack), in which case they can circumvent your CSRF protections anyway. </p>