Rails automatically adds CSRF protection to all forms by default by adding an authentication_token to all forms generated by the site.
I'd really like my site to have a simple sign up form on the front page of the site, which of course would be a static HTML page. This would ideally avoid hitting the Rails stack at all, allowing me to serve far more requests to the front page.
The downside of this is that it makes CSRF protection more difficult.
But I'm wondering if it is really necessary to have CSRF protection on a sign-up form, considering that CSRF attacks typically depend on the victim being logged in so that trust can be exploited. The sign-up form would log the user in if it validates correctly, but I don't think that would be any use to an attacker.
Is there an established view on this or a work-around using Rails/jQuery?
question from:https://stackoverflow.com/questions/15602473/is-csrf-protection-necessary-on-a-sign-up-form
