As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to the
form_key used in forms.
Well, there is
form_key passed as a cookie, but it seems to be ignored by the application and only PHPSESSID is important.
This means, that it is possible to change customer's cart data only having their PHP session ID and theoretically to fake a request.
Is there any other anti-CSRF-protection mechanism I'm missing? If not, can I be sure that this part of Magento (session authentication based REST API on checkout and cart pages) is CSRF-secure?
Thanks for anything that would help me better understand the protection mechanism of Magento API.
System: Magento 2.2.x