I'm building a CSRF protection on my application, and I am wondering on the best (or let's say least unsecure) way to transmit my CSRF token. The application enforces HTTPS, with TLS1.2.
When I generate the token on server side, I need to send it back to the client side (AngularJS stack). I can't use a cookie because they are all enforced to be secure and HttpOnly (so unreadable by AngularJS). So I'm left with setting it in a response header, or in the body response.
Same thing when the client will send a new request and will need to provide the token for verification. In the request header? As a body parameter (but this is a bit problematic as it would change the grammar of all the requests)?
TL;DR: Can I simply provide the token in the header response for server to client and in the request header for client to server?