We use an nginx reverse proxy to host two Rails apps under the same domain (one
/path leads to another 'secondary' app).
We don't currently have OAuth or anything 'proper' set up to protect those endpoints. They use the same cookie to determine who the user is, but CSRF is still an issue (we're not in prod with it yet).
Can I safely request server to server a CSRF token from the 'main' Rails app and provide that to my secondary single page app to send along with each request?
It seems safe and secure to me until we're able to implement OAuth or similar, but I'm not a security expert by any means.
example.com => provides API, app #1
example.com/special_path => routes to app #2, consumes app #1's API, uses same cookie to auth