Is the X-csrf-token only available for authenticated users?

Question

I am working on a rest api end point. I am noticing that some end points work without X-csrf-token header. Digging into the core revealed the following

  // This check only applies if
    // 1. the user was successfully authenticated and
    // 2. the request comes with a session cookie.
    if ($account->isAuthenticated()
      && $this->sessionConfiguration->hasSession($request)
    ) {
      if (!$request->headers->has('X-CSRF-Token')) {
        return AccessResult::forbidden()->setReason('X-CSRF-Token request header is missing')->setCacheMaxAge(0);
      }

This means that the X-csrf-token header is only checked for authenticated users. Are anonymous users not required to have this header? This really seems counter-intuitive to me as I feel that authenticated users already have a session cookie and its the anonymous users that need some kind of validation.

How do we add token validation for anonmyous users?

Answer 1

Drupal still doesn't use CSRF tokens for anonymous users. The CSRF token is also checked only when a session is available for the currently logged-in user, and only when the request method declared from the route is not one of the following: GET, HEAD, OPTIONS, TRACE.

There are some issues opened for Drupal core, which (at the moment I write this answer) still have to be fixed for Drupal 9.1.x, such as Allow form tokens to be used on anonymous forms in some cases (on January 24, 2024, its status is Needs work), CSRF check always fails for users without a session (Needs work), and X-CSRF-Token request header is missing when using Bearer authentication (Needs work).

The only way to add CSRF tokens for anonymous users is creating a new service that duplicates almost all the code in CsrfRequestHeaderAccessCheck, possibly using a route requirement that is different from _csrf_request_header_token used from Drupal core, and add that route requirement to the routes of your module that needs to be accessible also from anonymous users. Such service should also create a session, if it has not been already created.

Keep in mind that CSRF tokens are requested for those routes that alter data (for example, a route that deletes data from the database). If the route is simply showing data, the CSRF token is not required.