I am working on hash calculator coursework. This is simple web application which contains on the main page two submit forms where users allowed to submit hash and get text back and vise a verse.

Even though, the application is trivial, it requires to implement security features inside it. I managed to mitigate SQL and XSS attacks. Then, i decided to used two vulnerability assessment scanners "Acunetix" and "Nessus". Both scanners showed me that my application is vulnerable to CSRF and protection to this attack is to implement sessions and random tokens in PHP.

I have read about this attack and what it does. However, i got very confused due to the fact that this attack mainly focus on already authenticated users and cookies so my question is? Do i need to embed sessions and tokens to my application that simply return and recovers hash and plaintext?If yes, why i should do it and what potential threats around?

Thank you very much!