We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF.
So, what if we combine them in this manner:
1) Use access JWT token with csrftoken property in its payload and store this token in httpOnly and secure cookie and
2) Use csrftoken and store it in local storage. JWT token and csrftoken are submitted to a client on successful authorization. Browser submits JWT token to the server on each request and application passes scrftoken in a header. Server checks if csrftoken from JWT and header match and if not - blocks the request.
It seems like this scheme will protect us from both types of attacks. Malicious code injected to a page will not get access to JWT token (so no XSS) and malicious code run by a user outside our site will not force this user submit his/her csrftoken in a header (so, no CSRF).
So, I wonder if is a good practice and do they use this scheme in real world applications.
