I’m trying my hands on building a web application with React Frontend and Spring boot backend. My Frontend will talk to my Backend only via Rest API calls (No server-side generated pages will be sent).

My Login and Signup endpoints are POST. Spring expects that any request other than GET or HEAD must include the CSRF token (like in X-CSRF-TOKEN header).

Now, When I bring the CSRF piece to the puzzle, I get confused. My intuitive understanding is that only after successful authentication, a website should provide the user with the CSRF token. But since my login and signup endpoints are POST endpoints, they require CSRF tokens, which forces me to make my “CSRF token endpoint” unauthenticated and this feels odd to me.

When I asked Gemini, it told me,

You’re right, having an unauthenticated CSRF endpoint can feel insecure at first glance. However, it’s a common practice and considered safe when implemented correctly.

Can anyone confirm as I’m unable to find a SO question discussing on this subject?

If the CSRF endpoint is unauthenticated, what are some caveats I must be aware of?