title: why no csrf for GET requests
body: <p>I have read that there is no need for CSRF on GET requests since they are considered safe.</p>
  
  <p>However one scenario I can think of is an attack like this:</p>
  
  <pre><code>&lt;img src="https://otherdomain.com/logout" /&gt;
  </code></pre>
  
  <p>This would be bad without CSRF. Of course, one could require the logout route to require post, but I often see it implemented as a simple href.</p>
  
  <p>Furthermore, why are GETs safe at all? They still leak the data in the response...</p>