I have implemented CSRF for the public API I work on and all PUT&#x2F;POST requests require the CSRF token, not GET requests.  In this case, the login form uses a POST request and thus must require a CSRF token to avoid an attack on users that aren&#x27;t logged in.