title: How to protect against CSRF on a static site?
body: <p>I have a static website, being served from a CDN, that communicates with an API via AJAX. How do I protect against CSRF?</p>
  
  <p>Since I do not have control over how the static website is served, I cannot generate a CSRF token when someone loads my static website (and insert the token into forms or send it with my AJAX requests). I could create a <code>GET</code> endpoint to retrieve the token, but it seems like an attacker could simply access that endpoint and use the token it provides?</p>
  
  <p>Is there an effective way to prevent against CSRF with this stack?</p>
  
  <hr>
  
  <p>Additional details: authentication is completely separate here. Some of the API requests for which I want CSRF protection are authenticated endpoints, and some are public POST requests (but I want to confirm that they are coming from my site, not someone else's)</p>