Does CSRF protection for controller actions require POST? I've got a controller action which will work as the callback URL for OAUTH authentication with an external, third-party API. After authenticating, the external API will issue a GET request to my callback URL, which means I need to allow anonymous access for the action method. However, I'd like to use CSRF protection for it.

I've set enableCsrfProtection to true in my config/general.php file, and the tokenParam setting is token. I've also added protected $allowAnonymous = array('actionAuthCallback'); to my Controller.

Here's how I create the callback URL:

$callbackUrl = UrlHelper::getUrlWithToken(UrlHelper::getSiteUrl('actions/myplugin/mycontroller/authCallback'), craft()-&gt;request-&gt;getCsrfToken());


The resulting URL looks like this:  

https://mysite.com/actions/myplugin/mycontroller/authCallback?token=2423552353djfsjfdsfjsdfsdfrandomrandomawesome


I've validated that the correct action method fires, so all good so far.

Here's the important bits for the action:

public function actionAuthCallback()
{
    $this-&gt;requireToken();
    ...
    $this-&gt;returnJson(array(
        'success' =&gt; true,
    ));
}


If I call the action URL without the token query parameter, stuff works as expected – Craft throws a 400, as it should.

However, if I do include the token parameter in the URL, Craft throws a 404. What's even more confusing, this happens even if I leave out the $this-&gt;requireToken(); call in the actionAuthCallBack() method – as soon as Craft sees the token query parameter in the URL, the 404 exception is thrown.

What am I doing wrong? Does CSRF protection require POST requests?
According to https://craftcms.com/support/csrf-protection CSRF does require POST requests


  With CSRF protection enabled, all of your site’s visitors will get a “CRAFT_CSRF_TOKEN” cookie set on their browser, and all POST requests must be accompanied by a POST parameter with a matching name and value (the CSRF Token).


On top of that, you'll need to (manually) enable it in your config:


  You will need to enable it to take advantage of it. You can do that by setting the enableCsrfProtection config setting in your craft/config/general.php file.