I am using django rest framework for my backend and react for my front and they serve in different domain and subdomain and now I am completely confused what should I do for securing my APIs from XSS and CSRF attacks. I wish to use simple-JWT for the application but my research showed that it is vulnerable to XSS. and if I store them in http-only cookies they can’t be accessible in front end to add them in authorization header and it would be like using sessions, what should I do? and what is the best practice for securing APIs?
I would be glad to hear your suggestions