title: CSRF token exchange from server to AngularJS client
body: <p>I'm going crazy trying to figure out how to implement a CSRF protection for my Web app. I've read tons of pages but still cannot decide on the solution in my particular context.</p>
  
  <p>So, first my Web app is written in Angular, deployed statically on an Apache server. It calls some services on my server, Java type, deployed in a war on an application server. Both of them are deployed on the same domain. After authentication the usual session cookie (secure+HttpOnly) is set in the response. </p>
  
  <p>Now, I would like to implement a CSRF protection based on either a synchronizer token or a double submit cookie pattern (but from what I saw the first is a better solution as I can handle a state on server side).</p>
  
  <p>Most of the solutions I saw are proposing to generate the token server side and to store it in a cookie so it can be accessed on client side. The constraint for this to work, and I would that it is a big one, is that the cookie cannot be HttpOnly, as Javascript would not be able to access it. Moreover I have the feeling that sharing the token in a non fully protected cookie wouldn't be a good idea. But it seems to be the recommended solution from AngularJS ...</p>
  
  <p>So, if I discard this solution what am I left with?
  Putting the token not in a cookie but rather in the response header? Is it secure?
  Exposing a service to fetch the token? Seems practical but not sure if it is a good idea?
  Expose a servlet to build a Javascript to provide the token, like in OWASP Guard?
  Anything else?</p>
  
  <p>EDIT: It seems that Spring is going for the injection of the token name and value in the HTTP response as a solution.</p>
  
  <p>Thanks for your help! </p>