A site is vulnerable to XSRF if it doesn't use tokens when performing critical operations, critical operations are (usually) performed using HTTP POST, which can be done via form submission... token generation and validation is done server side...
You can perform a successful XSRF attack in a browser with javascript completely disabled.
Wait, so what am I thinking of? The phenomena where if you can get a website to display output of your choosing in a non sanitized way, you can abuse that to cause code to be executed by the user.
A site is vulnerable to XSRF if it doesn't use tokens when performing critical operations, critical operations are (usually) performed using HTTP POST, which can be done via form submission... token generation and validation is done server side...
You can perform a successful XSRF attack in a browser with javascript completely disabled.