I have a single page application that sends requests to a backend API after each user interractions (GET, POST….). For authentication, I use cookie session that the API return after the login to the SPA which store it in the cookies.

I added a CSRF token verification for POST, PUT operations that the api generates also after the login processand sends it in the body response.

My question is about security best practices, where should the CSRF token be stored in the front to protect against CSRF ? and why ?

I now I should avoid local storage because the token can be stolen very easily after a successful XSS attack. Storing the CSRF token in the cookies is not an option as the CSRF vulnerability comes from having tokens sent automatically from the cookie store.

The last option is using the session storage ? am I right or there a better option ?

Regards

I tried storing the token in the session storage but not sure if it is the best solution.