Any methods that alter the state of something. So, saving settings (which happens already if you are using \IPS\Helpers\Form), deleting, editing, etc. etc.
So, for instance, on a delete button you would do:
array(
'title' => 'delete',
'icon' => 'trash',
'link' => \IPS\Http\Url::internal( "app=myapp&module=mymodule&controller=mycontroller&do=delete" )->csrf(),
'data' => array( 'delete' => '' )
)
Then your delete method would do:
public function delete()
{
\IPS\Request::i()->confirmedDelete();
// ... etc ...
}
For any other method, you would do:
\IPS\Http\Url::internal( "app=myapp&module=mymodule&controller=mycontroller&do=somethingThatChangesSomething" )->csrf()
Then:
public function somethingThatChangesSomething()
{
\IPS\Session::i()->csrfCheck();
// ... etc ...
}
Most of the framework will largely handle this, however you should be mindful. A good example is flagging a member as a spammer in the admin members controller. This does not use a a form, or anything that would automatically apply a CSRF check, however it's an action that alters the state of the site (ban the user, hide their content, etc.). Therefore, it needs a CSRF check to make sure it was an action the administrator actually wanted to do.