title: Is it a security risk to include  'CSRF token' in pages requiring no authentication?
body: <p>I have a Django Site that uses Django's csrf-token for protection against csrf attacks. One of the forms can be accessed by public, including people who have not logged in.</p>
  
  <p>Csrf Token is supposed to give protection against cross domain requests.</p>
  
  <p><strong>Edit:</strong> (quote from my comment)
  "But, in case of post requests that are allowed without requiring authorization, csrf is no better than a trival spam filter(captcha would do better here). In fact, it should be a security risk to include CSRF token(that expire after say, 30 mins) in pages that require no authentication what so ever.(but my site is doing it, which is why I made this post in the first place)"</p>
  
  <p>Also, in this case, one could just fetch that page in browser js console, get the csrf token through some specific xpath and then post some arbitrary data with that csrf. Also, steps being easily reproducible, one could design a specific attack for the site, or any Django site for that matter cause you'll find csrf token besides <em>'csrfmiddlewaretoken'</em> every time (and that includes sites like reddit, pinterest etc.).</p>
  
  <p>As far as I can see, apart from making it a little difficult, csrf token didn't help much.</p>
  
  <p>Is there an aspect to it I am missing? Is my implementation wrong? and If I'am correct is it dumb to have your csrf token flying around in your html source(esp. those not requiring any authentication)?</p>