[AmericanChopper]

That sounds more like an integrity check than a CSRF control. Unless you have poor CORs settings, wouldn’t SOP prevent CSRF on PATCH endpoints anyway?

[edoceo]

It's that too. My point (still) being that passing state keys is old, common and still in use.