I have a two part question here.
Currently, I have a login system built which returns a login cookie containing an encrypted payload (encrypt-then-MAC). I am reasonably sure the cookie contents cannot be tampered with or forged without my knowledge.
I know that using said cookie to protect my endpoints is vulnerable to CSRF, since the cookie is automatically submitted by the browser with any request. I also believe that the Double Submit Cookie pattern is discouraged because it requires setting the cookie HTTPOnly value to False, which elevates the risk of certain attacks.
My first question is, are there any obvious flaws with this flow? It seems like a reasonable adaptation of the Synchronizer Token Pattern for REST, but I would like to know if there are serious flaws or if there are other best practices around the procedure.
I have considered implementing the OAuth 2.0 Implicit Grant flow but I would like the auth cookie to be present so I can persist logins for a moderate amount of time.
I have scoured google for the answer, and my google-fu has failed me. All I could find were numerous articles about reading HTTPOnly cookies, but not submitting them.
Thanks in advance for any help or advice!