diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index 524c201..e984d13 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -677,6 +677,10 @@ public function prepareForm($form_id, &$form, FormStateInterface &$form_state) {
     // Fix the form method, if it is 'get' in $form_state, but not in $form.
     if ($form_state->isMethodType('get') && !isset($form['#method'])) {
       $form['#method'] = 'get';
+    }
+
+    // Get forms should not get CSRF Tokens.
+    if (isset($form['#method']) && $form['#method'] === 'get') {
       $form['#token'] = FALSE;
     }
 
diff --git a/core/modules/system/src/Tests/Form/FormTest.php b/core/modules/system/src/Tests/Form/FormTest.php
index 389d23e..4da70a9 100644
--- a/core/modules/system/src/Tests/Form/FormTest.php
+++ b/core/modules/system/src/Tests/Form/FormTest.php
@@ -295,6 +295,18 @@ public function testInputWithInvalidToken() {
   }
 
   /**
+   * CSRF Tokens for GET forms should not be added.
+   */
+  public function testGetFormsPreventCsrfToken() {
+    // We need to be logged in to have CSRF tokens.
+    $account = $this->createUser();
+    $this->drupalLogin($account);
+
+    $this->drupalGet(Url::fromRoute('form_test.get_form'));
+    $this->assertNoRaw('form_token');
+  }
+
+  /**
    * Tests validation for required textfield element without title.
    *
    * Submits a test form containing a textfield form element without title.
diff --git a/core/modules/system/tests/modules/form_test/form_test.routing.yml b/core/modules/system/tests/modules/form_test/form_test.routing.yml
index a37990b..d8c5833 100644
--- a/core/modules/system/tests/modules/form_test/form_test.routing.yml
+++ b/core/modules/system/tests/modules/form_test/form_test.routing.yml
@@ -473,3 +473,10 @@ form_test.form_storage_page_cache:
     _title: 'Form storage with page cache test'
   requirements:
     _access: 'TRUE'
+
+form_test.get_form:
+  path: '/form-test/get-form'
+  defaults:
+    _form: '\Drupal\form_test\Form\FormTestGetForm'
+  requirements:
+    _access: 'TRUE'
diff --git a/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php b/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
index d95e3bc..9a9fe4c 100644
--- a/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
+++ b/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
@@ -773,7 +773,7 @@ public function providerTestInvalidToken() {
    *
    * @dataProvider providerTestFormTokenCacheability
    */
-  function testFormTokenCacheability($token, $is_authenticated, $expected_form_cacheability, $expected_token_cacheability) {
+  public function testFormTokenCacheability($token, $is_authenticated, $expected_form_cacheability, $expected_token_cacheability, $method) {
     $user = $this->prophesize(AccountProxyInterface::class);
     $user->isAuthenticated()
       ->willReturn($is_authenticated);
@@ -782,6 +782,7 @@ function testFormTokenCacheability($token, $is_authenticated, $expected_form_cac
 
     $form_id = 'test_form_id';
     $form = $form_id();
+    $form['#method'] = $method;
 
     if (isset($token)) {
       $form['#token'] = $token;
@@ -797,7 +798,7 @@ function testFormTokenCacheability($token, $is_authenticated, $expected_form_cac
 
     $form_state = new FormState();
     $built_form = $this->formBuilder->buildForm($form_arg, $form_state);
-    if (!isset($expected_form_cacheability)) {
+    if (!isset($expected_form_cacheability) || $method == 'get') {
       $this->assertFalse(isset($built_form['#cache']));
     }
     else {
@@ -820,10 +821,11 @@ function testFormTokenCacheability($token, $is_authenticated, $expected_form_cac
    */
   function providerTestFormTokenCacheability() {
     return [
-      'token:none,authenticated:true' => [NULL, TRUE, ['contexts' => ['user.roles:authenticated']], ['max-age' => 0]],
-      'token:false,authenticated:true' => [FALSE, TRUE, NULL, NULL],
-      'token:none,authenticated:false' => [NULL, FALSE, ['contexts' => ['user.roles:authenticated']], NULL],
-      'token:false,authenticated:false' => [FALSE, FALSE, NULL, NULL],
+      'token:none,authenticated:true' => [NULL, TRUE, ['contexts' => ['user.roles:authenticated']], ['max-age' => 0], 'post'],
+      'token:none,authenticated:false' => [NULL, FALSE, ['contexts' => ['user.roles:authenticated']], NULL, 'post'],
+      'token:false,authenticated:false' => [FALSE, FALSE, NULL, NULL, 'post'],
+      'token:false,authenticated:true' => [FALSE, TRUE, NULL, NULL, 'post'],
+      'token:none,authenticated:false,method:get' => [NULL, FALSE, ['contexts' => ['user.roles:authenticated']], NULL, 'get'],
     ];
   }