I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my API server on a different domain. The API CORS policy is whitelisted to accept requests from the js application.
Is the CSRF token requested via ajax secure? Can't the origin headers be spoofed by anyone who wants to obtain a valid CSRF token? (The token is generated by Laravel)