将CSRF令牌发送到javascript

Question

Suppose I maintain a anti CSRF token at server side in a session

How am I supposed to pass the token to client side application if my form generation is going to be dynamic(i.e. form will be created after some action has been performed by javascript)

Is there a way to pass the token to javascript so that I can inject the token in the form.

One working way that I found is send a cookie to the browser containing the token which will be then extracted by javascript.

Any suggestions?

Answer 1

Sure. If you're dynamically generating the form on the client side then you're doing it from some kind of template. The token should be an argument to that creation function.

Pass the token along to the client at request/render time and then inject it into the form as a hidden element at form generation time.