This question already has an answer here:
- Ajax and CSRF protection 2 answers
A conventional CSRF token is put into the body of the HTML page and either used by a
Is it safe to request a CSRF token from the server during application startup with an AJAX request? The resulting token could then be attached as a header to all of the future requests to the API.
Is there a better solution to protecting against CSRF attacks in my architecture?