title: Set the XSRF cookie on the client side
body: <p>I want to implement a CSRF prevention mechanism for my application by setting a cookie and sending an HTTP header with the same value with every POST / PUT / DELETE request. Everywhere I read, the best practices suggest that the csrf cookie should be set from the server. I'm building a single page app using AngularJS and they also suggest that for security reasons the cookie should be send by the server on the first GET request.</p>
  
  <p>My question is - why should the server send the cookie and not just set it on the client using simple javascript and a generated random uuid value?</p>
  
  <p>Also, if you have a public app that can be accessed by everyone and still need to protect it from csrf, how would the server side remember what token it sends to what user, if they do not have session cookies?</p>