I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection,
I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when the user successfully logs in, he will get (in addition to the cookie) a CSRF token(random string) in the response payload, same token is being added as a claim to the JWT payload, on user side token will be stored in localStorage.
When user calls an authenticated rest endpoint he attached the CSRF token as a header("csrf-token": "randomToken" header) as we are stateless all request will first validate the JWT signature, and after the validation the code will check if the token in the JWT payload is equal to the one in the request header.
As I didn't find any proposition for this sort of a solution I am suspecting this is not 100% hack proof, but I can't understand why, any help would be appreciated,
Many thanks