title: What is the correct way for a client to store a CSRF token?
body: <p>I make a call to a server on the <code>/login</code> endpoint, and it returns a session cookie as well as CSRF token in the return values (cannot store this as a cookie as it is not secure). Where can I store the CSRF value on the client so I can use it in my calls to the server? If it is just in the JS memory, I lose it as soon as I leave the page even if my session is still valid, and storing as a cookie is not secure. Or is it not possible to store and I have to hit an endpoint to get one every time I close the page?</p>