I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax.
They are under the same domain but in different ports.
server api ---- www.example.com:9000/api/endpoints
web app ---- www.example.com:9001
Now, we save two types of cookies.
user-session-cookie # authenticate the user. secure = True, http = True
csrftoken # secure = True
I wonder in general, is this implementation secure? In what circumstance the site is not secure?
I don't mark csrftoken http = True because the javascript app need get the csrftoken to send requests. However, I am exposing the csrftoken to an XSS attack. Is there anyway I can prevent csrftoekn from XSS attack?