I know there are multiple places to put a csrf token and the most common one is to put in a hidden input field in a form. Second is in a cookie with the httpOnly flag. What I want to know is, is there an opposition to placing it in a javascript variable so that it can be used every time a post request is made to change data.
Otherwise you have to place it in a form’s hidden field for every form and it could be a problem if the form is dynamically generated.