I've done some researches on this topic, and I found this question on SE: Sending session cookie inside the HTTP response body
But this answered my question just in part.
On login, my server will create a httpOnly cookie, and also put this authorization token in the response body. This is because my server handles normal HTTP requests from a browser, and also provides RESTful APIs.
In case of an API request, the client will then find the token in the response body and use it accordingly. (I believe that the cookie won't be received because the request is not made through a normal browser, correct me if I am wrong.)
In case of a browser request, the token will be received as a httpOnly cookie, but also in the response body. My doubt is: wouldn't this just nullify the fact of using an httpOnly cookie, since I'm also sending the token in the response body?
The problem arises because I need to handle also API calls, which is why I send the token in the response body.
I hope my question is clear.