I'm building a CSRF protection on my application, and I am wondering on the best (or let's say least unsecure) way to transmit my CSRF token. The application enforces HTTPS, with TLS1.2.

When I generate the token on server side, I need to send it back to the client side (AngularJS stack). I can't use a cookie because they are all enforced to be secure and HttpOnly (so unreadable by AngularJS). So I'm left with setting it in a response header, or in the body response.

Same thing when the client will send a new request and will need to provide the token for verification. In the request header? As a body parameter (but this is a bit problematic as it would change the grammar of all the requests)?

TL;DR: Can I simply provide the token in the header response for server to client and in the request header for client to server?


  • yes, or in the body, which is simple when serving json, html, or js; it's not a big secret... – dandavis Oct 8 '17 at 5:55
  • Thanks @dandavis for your reply. In the case of body with JSON the only drawback I see is that you'd need to update your datamodel for each and every services (assuming you have a kind of framework there to work that out for you). – Xendar Oct 8 '17 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.