Should csrf be a required attribute?

[koddsson]

Right now, we exit early if there is no CSRF token. Maybe we should allow users to supply a CSRF token and not mandate it optionally?

auto-check-element/src/index.ts

Lines 102 to 105 in 2310898

	// If some attributes are missing we want to exit early and make sure that the element is valid.
	if (!src || !csrf || !state) {
	return
	}

[rebelagentm]

FWIW, there may be some applications outside of dotcom that wouldn't need to set this.