We know that
secure flag are immune to
XSS and vulnerable to
CSRF attacks. And at the same time we know that
local storage is vulnerable to
XSS, but can protect against
So, what if we combine them in this manner:
1) Use access
JWT token with csrftoken property in its payload and store this token in httpOnly and secure cookie and
2) Use csrftoken and store it in local storage. JWT token and csrftoken are submitted to a client on successful authorization. Browser submits JWT token to the server on each request and application passes scrftoken in a header. Server checks if csrftoken from JWT and header match and if not - blocks the request.
It seems like this scheme will protect us from both types of attacks. Malicious code injected to a page will not get access to JWT token (so no XSS) and malicious code run by a user outside our site will not force this user submit his/her csrftoken in a header (so, no CSRF).
So, I wonder if is a good practice and do they use this scheme in real world applications.