I see that $form['#token'] is employed in drupal_prepare_form() and drupal_validate_form() as a protective measure against cross-site request forgery.

I am wondering about the necessity of this measure on site-search forms specifically, including core's search_box() and search_form() as well as a form built from scratch in a module that similarly implements a search by feeding arguments into a view.

I believe I have seen it mentioned (though I can't recall where) that the search forms would be a viable case in which to work around the token protection. But then, why doesn't core do so by default?

(Note: I'm not asking for help with code to work around it, as I've figured that part out already.)

I see that $form['#token'] is employed in drupal_prepare_form() and drupal_validate_form() as a protective measure against cross-site request forgery.

I am wondering about the necessity of this measure on site-search forms specifically, including core's search_box() and search_form() as well as a form built from scratch in a module that similarly implements a search by feeding arguments into a view.

I have seen it mentioned (in drupal_prepare_form(), in fact, and possibly other places I can't recall) that the search forms would be a viable case in which to work around the token protection. But then, why doesn't core do so by default?

(Note: I'm not asking for help with code to work around it, as I've figured that part out already.)