CSRF: when your app needs protection and when it does not

• Cookie-based sessions: yes, review it.
• Bearer tokens that your JavaScript adds to each request: the browser will not add them for another site, so classic CSRF does not apply.
• Any GET route that changes data is unsafe regardless of the session type.

For POST, PUT, PATCH and DELETE, compare the Origin header with your own host and reject mismatches.

const origin = request.headers.get('origin');
const host = request.headers.get('host');
if (!origin || new URL(origin).host !== host) {
  return new Response('Forbidden', { status: 403 });
}

For money movement, email or password changes and account deletion, require a per-session token that a cross-site page cannot read, or ask the user to re-enter their password.