I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over that user up to their given permissions. The request to generate the api-token is made via an AJAX GET request on the same domain.
By default CORS is blocking cross site requests. I've read that I shouldn't rely on CORS only for CSRF protection. But CSRF protection mechanisms don't seem to apply here because it's a GET request providing the sensitive data.
So, if an attacker obtains another users cookie (ie: XSS from another domain to get at a users cookie) and I want to prevent them from being able to retrieve that person's api-token using said stolen cookie. What are my options? Are there additional precautions I should be taking to protect this api-token given it's authentication mechanism?