CSRF on module forms for anon users My module has 2 small forms which allow visitors to submit certain information. 

Problem is when I am not logged in, no CSRF token is being added to the forms - so anonomous users/everyone are bypassing the CSRF. Can't find any documentation on this issue, could anyone point me in the right direction so i can get my CSRF tokens?

It is a requirement of my security testing that all forms include CSRF.
If you look at drupal_prepare_form() it says


  since tokens are session-bound and forms displayed to anonymous users are very likely cached, we cannot assign a token for them.


If you do want to go ahead with this, the following works when quickly tested with the default search and comment forms.

function MYMODULE_form_alter(&amp;$form, &amp;$form_state, $form_id) {
  if (!isset($form['#token'])) {
    $form['#token'] = $form_id;
    $form['form_token'] = array(
      '#id' =&gt; drupal_html_id('edit-' . $form_id . '-form-token'), 
      '#type' =&gt; 'token', 
      '#default_value' =&gt; drupal_get_token($form['#token']),
    );
  }
}


Be careful about page caching however (and a reverse proxy if you use one) if you do go down this road.