Currently, my architecture as follows.
- API is served from
- Frontend application is served from
I'm concidering two different methods for CSRF protection:
- Letting the frontend acquire a CSRF token by making a request to
api.domain.com/getCSRFafter it loads the first time.
- Enable CORS on my
api.domain.comand allow request only from
I found a major website using my first approach to get the CSRF token, but I don't think it's a good approach. Which one of my methods is better for CSRF protection?