Just to make sure I understand this correctly: is this only a security issue if you include sensitive information on a page by default? For instance, if you ha

Just to make sure I understand this correctly: is this only a security issue if you include sensitive information on a page by default? For instance, if you had a search field, the contents of what users puts in that search field will not be compromised. However, if you include a csrf token with the search field form, that can be compromised since it will be there every time the attacker gets the victim to make a request.