title: Is CSRF Protection necessary on a sign-up form?
body: <p>Rails automatically adds CSRF protection to all forms by default by adding an <code>authentication_token</code> to all forms generated by the site.</p>
  
  <p>I'd really like my site to have a simple sign up form on the front page of the site, which of course would be a static HTML page. This would ideally avoid hitting the Rails stack at all, allowing me to serve far more requests to the front page.</p>
  
  <p>The downside of this is that it makes CSRF protection more difficult.</p>
  
  <p>But I'm wondering if it is really necessary to have CSRF protection on a sign-up form, considering that CSRF attacks typically depend on the victim being logged in so that trust can be exploited. The sign-up form <em>would</em> log the user in if it validates correctly, but I don't think that would be any use to an attacker.</p>
  
  <p>Is there an established view on this or a work-around using Rails/jQuery?</p>