title: Is CSRF protection needed in case of OAUTH2
body: <p>I have a <code>REST application</code> created with <code>Spring Boot</code> and protected with <code>Spring Security Oauth2</code> support. I'm using <code>Cloudfoundry UAA</code> as third party token provider.</p>
  
  <p>There's no session in the application and every request has to be accompanied with the Oauth2 token provided by <code>UAA</code>. Is it still necessary to protect REST services against <code>CSRF</code> attack?</p>
  
  <p>As there's no way a malicious site can get a valid Oauth2 token from my UAA service.</p>
  
  <p>Thanks</p>