CSRF on /login security alert from security scans

Product Support Self-hosting
6

@David We did some more digging and monitoring of the requests and responses. It looks like the the CSRF token is not granted until the user logs in. When visiting the site the CSRF token is not being assigned. This is what our security folks are flagging - no CSRF token until logged in therefore, on initial visit we do not have a CSRF token. Is this intentional?

If we are logged in we see the following in the response:

<meta name="csrf-param" content="authenticity_token" />
<meta name="csrf-token" content="TOKEN" />

Here is a get/response when not logged in. We do not see a meta tag with the csrf.

GET / HTTP/1.1
Host: astrodiscuss.usgs.gov
Connection: close
Purpose: prefetch
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

HTTP/1.1 200 OK
Server: nginx/1.14.0
Date: Wed, 19 Dec 2018 17:07:47 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
X-Discourse-Route: list/latest
Cache-Control: no-cache, no-store
X-Discourse-Cached: true
X-Request-Id: 2df19db3-ca64-4920-a909-073854ab2b03
X-Runtime: 0.001948
X-Discourse-TrackView: 1
Strict-Transport-Security: max-age=31536000
Content-Length: 57226

<!DOCTYPE html>
<html lang="en" class="desktop-view not-mobile-device  anon">
  <head>
    <meta charset="utf-8">
    <title>AstroDiscuss</title>
    <meta name="description" content="USGS Astrogeology Discussion">
    <meta name="discourse_theme_ids" content="1">
    <meta name="discourse_current_homepage" content="latest">
    <meta name="author" content="">
<meta name="generator" content="Discourse 2.2.0.beta5 - https://github.com/discourse/discourse version 414aa1fe7a8e968b00a8bd8e103ce34a42a25028">
<link rel="icon" type="image/png" href="/images/default-favicon.ico">
<link rel="apple-touch-icon" type="image/png" href="https://astrodiscuss.usgs.gov/images/default-apple-touch-icon.png">
<meta name="theme-color" content="#111111">
<meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0, user-scalable=yes">

<script type="application/ld+json">{"@context":"http://schema.org","@type":"WebSite","url":"https://astrodiscuss.usgs.gov","potentialAction":{"@type":"SearchAction","target":"https://astrodiscuss.usgs.gov/search?q={search_term_string}","query-input":"required name=search_term_string"}}</script>
<link rel="search" type="application/opensearchdescription+xml" href="https://astrodiscuss.usgs.gov/opensearch.xml" title="AstroDiscuss Search">
...(more HTML)