web - Should we check CSRF token for read only actions -

i have heard many people suggest csrf handling mandatory actions performing write operations optional action performing read operations?

if yes please share example how action performs read operations can exploited using csrf.

ordinarily safe methods not have protected against csrf because not make changes application (i.e "read only" state in question), , if they're returning sensitive information protected same origin policy in browser.

if site implemented per standards, requests should safe , therefore not need protection.

however, there specific case "cross-site dos"^* attack executed. reporting page takes 10 seconds execute, 100% cpu usage on database server, , 80% cpu usage on web server.

users of website know never go https://yoursite.example.org/analysis/getreport during office hours because kills server , gives other users bad user experience.

however, chuck wants knock yoursite.example.org website offline because doesn't or company.

on busy forum company employees frequent, http://forum.walkertexasranger.example.com, sets signature following:

<img src="https://yoursite.example.org/analysis/getreport" width=0 height=0 /> 

every time 1 of chuck's posts read employees, authentication cookies sent https://yoursite.example.org/analysis/getreport, site processes request , generates report, , system goes offline because cpu eaten these constant requests.

so though request request , doesn't make permanent changes system (aka "safe"/"read only"), in fact bringing down system every time ran. therefore, better protect csrf prevention method , maybe implement post.

^{*xsdos, or cross-site denial if service, phrase coined me, don't go googling it.}