在REST API端验证CSRF令牌

Question

I have REST API written on PHP with authentication based on JWT. Workflow is simple: user sends username and password and gets JWT token back, with what they will be authenticated on all REST requests. Everything is pretty logic and cool, but now i have a problem with storing token client side, after some googling i found what only HTTP Only, Secure cookies are good for this, but they are vulnerable for CSRF attacks, so i am planning to user CSRF token to solve this problem. And here comes the question, how REST can validate CSRF token, if token issued by client? How REST backend understand what this random string is valid for this request and another random string is not? REST is stateless, he doesn't know what kind of token client have issued because REST and client are on separate backends, even on separate servers.