I'd go with a guideline of if a form gets submitted through POST then it should in most cases have keepalive since that form should have a CSRF check behind it (forms like a create item form, edit form, login form, contact form, etc.), and if it gets submitted through GET it doesn't need a keepalive behavior because these types of forms should essentially be nothing more than query filters for a page. I say this also realizing the backend views are in kind of a FUBAR state because the search filters trigger a POST form submission, and it looks like the frontend com_content.archive view has the same "issue" which means Joomla isn't always using the appropriate HTTP action to do things sadly.

Thanks - I can work with that. I assume therefore that any form with keepalive must have the csrf check as well.

partial PR in #25638

It's not an implicit thing. All keepalive does is keep the session alive. However yeah basically all our forms should have a csrf check to try and stop request forgeries as a rule of thumb (can't think of any exceptions in core)

re-opening so it can be checked further after todays release

So to confirm
every time we have a <form action we should also have a form.token
Because we dont