Question: odoo urls are csrf-protected by default?
Answer: Odoo URLs are CSRF-protected by default (when accessed with unsafe HTTP methods). See https://www.odoo.com/documentation/12.0/reference/http.html#csrf for more details.