Csrf is not dependent on js. It happens via normal links on external sites.
That's what I said, yes.
Sorry, I misread your comment
That's what I said, yes.
Sorry, I misread your comment