title: are precautions against CSRF needed for view-only pages?
body: <p>All the examples of CSRF exploits tend to be against pages which process the incoming request.</p>
  
  <p>If the page doesn't have a form processing aspect do I need to worry about CSRF ? </p>
  
  <p>The situation I'm looking @ :</p>
  
  <ul>
  <li>the page in question contains sensitive data</li>
  <li>as such users need to establish a session to view the page</li>
  </ul>
  
  <p>... my understanding is that a malicious page will be able to redirect a client to this page by embedding a link to it, however since there's no action on the target to perform there's no harm that can result, right ? </p>
  
  <p>There's no way for said malicious site can <em>view</em> the sensitive page, correct ?</p>
  
  <p><strong>Why I ask:</strong> I want the url to the page with sensitive data to have a 'simple' URL which allows people to email the link to other people (who will in turn need a session to view the page). The token-based solution I've seen for most CSRF solutions remove this possibility, and so I'd like to avoid them if possible. </p>