There is little you can or need to do to guard the CSRF token. Perhaps there is more, but I can only think of three things:

• Don't put it in a URL parameter where it will be logged in all sorts of places.
• If you are only serving your site over HTTPS, mark any cookies involved as secure.
• Invalidate the token both client side (via cookie settings) and server side so that old tokens can not be used.

And then there is the issue of XSS. If you are vulnerable to that, it could be used to steal the CSRF token, since it can not be HTTP-only. There is nothing you can do about this, other than making sure you are not vulnerable to XSS. Use CSP, sanitize your input with a good library, scan your site, etc, etc.

However, if you have XSS issues you have bigger problems than the CSRF token being stolen.

There is little you can or need to do to guard the CSRF token. Perhaps there is more, but I can only think of four things:

• Don't put it in a URL parameter where it will be logged in all sorts of places.
• If you are only serving your site over HTTPS, mark any cookies involved as secure.
• Invalidate the token both client side (via cookie settings) and server side so that old tokens can not be used.
• Be careful with CORS so that you do not accidentally make something containing the token available from another origin.

And then there is the issue of XSS. If you are vulnerable to that, it could be used to steal the CSRF token, since it can not be HTTP-only. There is nothing you can do about this, other than making sure you are not vulnerable to XSS. Use CSP, sanitize your input with a good library, scan your site, etc, etc.

However, if you have XSS issues you have bigger problems than the CSRF token being stolen.