Security is not black and white. It is a spectrum of possibilities and an arms race between security measures and new attack strategies. So lowering all your ba

Security is not black and white. It is a spectrum of possibilities and an arms race between security measures and new attack strategies. So lowering all your barriers because one of them could be already weak is not a good strategy. If you're sending your password in plain text without HTTPs, then saying "ok, nevermind, we already have that problem so let's just not use any CSRF protection" you're just making things worse. Authentication tokens that allow anyone reading them to impersonate you are bad, no discussion about it. Go and google for this if you don't believe me. Ask any security expert (which I'm not). Cookies have the exact same problem. Except if you set the http-only flag in them, which is what I'm advocating for here. You can still use localStorage, just not for security tokens.