Is CSRF a threat if not using cookies?

Question

My Flask app is AJAX-heavy, but does not use any cookies. Is CSRF still a threat or is it safe to deploy the app as of now?

I have already looked at this SO question but my situation is slightly different, since I do not have to worry about user's credentials.

I tried an AJAX call from Chrome DevTools (using $.ajax()) to my server which was running on localhost (Flask development server) and I got an error saying

XMLHttpRequest cannot load http://localhost:5000/_ajax. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'chrome://newtab' is therefore not allowed access.

Does this mean I am safe, or is it possible that a hacker could circumvent this and still make AJAX calls to my server?

Answer 1

CSRF isn't just protection against CORS AJAX. I could make a form on my site, and set the action to http://yoursite.com/account/delete. If a user submits my form, without CSRF on your site, the action would succeed. Or if you have things change on GET requests (shouldn't do that anyway), I could add this to my site:

<img src="http://yoursite.com/account/delete" />

and the action would happen when my page loads.

Check out Flask-WTF or this snippet: http://flask.pocoo.org/snippets/3/

EDIT

From your comment:

Change the action of that page to a POST, and have it be accessed through a form instead of a link. If your link was:

<a href="{{ url_for('my_page') }}">Click Here</>

Your form could be (using Flask-WTF, which you would need):

<form action="{{ url_for('my_page') }}" method="POST">
    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
    <input type="submit" value="Click Here" />
</form>