What's the best way to skip CSRF for plugin controllers? I'm working on a plugin that'll create a private API for content authors to post entries to Craft from desktop-based scripts. These scripts post data to plugin controller actions (anonymous-allowed), where the plugin will first check for valid Craft user account details or a plugin-generated key.

Since I'm still enforcing authentication, what's the best way to disable CSRF checks just for these posts when CSRF is globally enabled?

Thoughts I've had:


Attempt to put the CSRF key and token in the $_POST data as early as possible. (Probably not even possible.)
Have the client (desktop) script grab the CSRF key+token just before posting. (Inconvenient, potentially failure-prone.)
Somehow prevent CSRF protection from being enabled for requests passed to this controller.
In Craft 3 this is a cinch:

class PluginController extends Controller
{
    // Disable CSRF validation for the entire controller 
    public $enableCsrfValidation = false;

    ...


See the Yii2 docs for more control over inividual actions:
https://github.com/yiisoft/yii2/blob/master/docs/guide/security-best-practices.md#avoiding-csrf