Let us say we have an SPA being served by nginx at domain example.com and a REST API hosted at api.example.com.
Authentication between the SPA and the API happens through a JWTs. A short lived (15 min) access-token that is stored by the SPA in localstorage and a longer lived (days) refresh-token that is set by the server on an HttpOnly cookie. CORS is permitted on the server for the domain example.com.
Problem 1: I was discussing this yesterday with a colleague and they believe that because my refresh token resides in a cookie, I require CSRF protection for my application. I disagreed on the account that the refresh-token can not be used to "access" any private resource and is only checked for by the server during a GET request to a specific end-point which exposes the token exchange mechanism to the SPA.
Q1. Is this reasoning correct? Is there any way that a refresh-token in an HttpOnly cookie be exploited maliciously?
Problem 2: Thinking further on the subject, even if we were to go for some CSRF protection, if for nothing then peace-of-mind. How would you go about sending the token to the client in the first place? We do not use forms and render the UI completely on the client so a hidden field is out of the question, the index file is served by nginx so we can not embed a meta tag on the HTML either.
Q2. Is there any way to make CSRF protection work for a Single Page Application?