I ended up researching CSRF protection on Rest API endpoints, and whether or not they are required. This lead me to this old question:
Which has been used as a reference to close questions about whether or not Rest APIs need CSRF tokens:
The problem is, I believe that this canonical question started from a false premise which resulted in incorrect answers, and is now being used to close duplicate questions about this topic, which I would very much like to discuss. In detail:
The original question asked "Is it okay to use a custom header to perform CSRF protection on REST endpoints and not validate the token?". What I want to know, but which this question didn't ask, is "Is it necessary to use CSRF protection on REST endpoints at all?". Rather, the question assumed that CSRF protection is required, and got answers that also worked from that assumption.
Having given it a lot of thought, I'm very certain that CSRF protection is not at all helpful to REST endpoints, and that you are better off skipping it altogether. Given this, I think the "standard" thing to do would be to add another answer to the question. However, there is a problem: I would actually like some input about this question myself. While I am pretty sure I am correct (that CSRF is unnecessary here), I'm not 100% certain, and I would like to see what others think. I legitimately want to ask a question. The question I want to ask is not discussed in this canonical question, but this question has been used to close other questions when others asked exactly what I want to ask. I also feel like commenting on the original question or answers is not going to work for me, because this isn't just a matter of clarification: there are a number of details to discuss.
As a result I don't have an answer to my question, and I suspect that if I try to ask my question it will just get closed as a duplicate. This, of course, is why I'm posting this here. What is the best way to proceed? Should I ask my question and start off with a discussion about why it is not a duplicate? I feel like that will detract from the question itself. Can I get some suggestions here and then reference this meta-post if posting another question is the right answer?