First of all, CSRF and XSRF reffer both to Cross Site Request Forgery.
Second of all, unless you put an anti-CSRF token in a cookie, atleast the HttpOnly attribute should be set if possible.
If you serve your REST API over HTTPS, then the Secure attribute on the anti-CSRF cookie should be set as well.
This URL explains how to use and configure anti-CSRF tokens in the Spring MVC framework.
This URL explains how to use anti-CSRF tokens in PHP without using a PHP framework.
There are situation where an attacker is able to steal HttpOnly cookies:
- The HTTP TRACE method is enabled
- Outdated Apache (CVE-2012-0053) (< v2.2.22)
If these two conditions are not met, based on your description, I would say your code is sufficiently protected against CSRF attacks, especially since you use request based anti-CSRF tokens (I know banks that don't even do this). Good job! :)
However, do not try to re-invent the wheel. Personally I would try to implement a proper anti CSRF protection using the Spring MVE framework.