Is bypassing Drupal's #token protection against CSRF safe for search forms specifically?

Question

I see that $form['#token'] is employed in drupal_prepare_form() and drupal_validate_form() as a protective measure against cross-site request forgery.

I am wondering about the necessity of this measure on site-search forms specifically, including core's search_box() and search_form() as well as a form built from scratch in a module that similarly implements a search by feeding arguments into a view.

I have seen it mentioned (in drupal_prepare_form(), in fact, and possibly other places I can't recall) that the search forms would be a viable case in which to work around the token protection. But then, why doesn't core do so by default?

(Note: I'm not asking for help with code to work around it, as I've figured that part out already.)

Answer 1

I think the biggest question when judging a potential CSRF problem is whether some form of damage will be done if a user is tricked into taking the action. If there is a CSRF vulnerability that deletes a user or unpublishes a node, that would be a problem. But being tricked into executing a search is only potentially a problem in terms of the resources a search takes to execute (which is not that much). Even if the core search doesn't bypass the token, it is accessible as a GET url (search/node/keyword) so someone could be tricked into visiting that URL bypassing the form in front.

Another way to think about it is whether the action is idempotent. A search is an idempotent action (by the W3 definition, log records might be created, but that's not a big deal), so it doesn't need CSRF protection.

Answer 2

This seems to bring about reasons why you should never bypass #token: CSRF: Avoid security holes in your Drupal forms.

And the specific instances you've provided don't seem to warrant bypassing #token.