dont require csrf for post requests that have no cookies AND no HTTP authentication

[komuw]

Browsers send cookies along with all requests. CSRF attacks depend upon this behavior. If you have no cookies and no http authentication, you dont need csrf protection.

• https://security.stackexchange.com/a/166798

you do not need to implement CSRF counter-measures on your resource server, if you are not using cookies (sessions) and you are not using basic authentication within the browser.

• https://security.stackexchange.com/a/189812

http authentication

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication

[komuw]

if request.hasNoCookies() && 
   request.hasNoHttpAuthenticationHeaders() && 
   request.hasNoHttpForm(both application/x-www-form-urlencoded or multipart/form-data) {
    
       // exempt from csrf
}