CSRF doesn't require any javascript to defend against. Having a nonce inside of the HTML resolves that completely. SameSite and Secure cookies also don't requir

CSRF doesn't require any javascript to defend against. Having a nonce inside of the HTML resolves that completely. SameSite and Secure cookies also don't require any javascript, just some extra HTTP headers. I don't think security justifies this.