Is it safe to include the CSRF token as part of an HTTPS successful login JSON response in an SPA? If not, is there a better mechanism for sending it which avoids the Double Submit Cookie pattern?
Some background:
I am building an SPA application (Node/React) which communicates HTTPS with a JSON API backend and I am trying to determine if sending the CSRF token from the server in the login response JSON is a safe thing to do.
I have researched OWASP's suggestions for sending a CSRF token from the server that states:
The CSRF token can be added through hidden fields, headers, and can be used with forms, and AJAX calls
However this does not seem to address SPA concerns. I have also found that the Angular framework uses the Double Submit Cookie pattern, but sources (including OWASP's) indicate this is a less secure approach.
OWASP has also suggested including it in the DOM in a meta tag, however since it should only be issued to authenticated users, I thought it made more sense to include it with the successful login JSON response.
Is this a safe approach to sending a CSRF token? Thanks in advance.