Is it a good practice to store the csrf token in meta tag?

问题

If I make a POST request without using form and want to prevent CSRF attack, what I can do is to set the csrf-token in meta tag and put it back to the header when the request is triggered. Is it a good practice?

<meta name="csrf-token" content="xxx">

Put the token back via the header, using JQuery for example:

$.ajaxSetup({
   headers: {
      'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
   }
});

回答1:

Yes this is good practice. If you are using ajax I think this is the cleanest solution.

You could also put the token inside of the form (which is more convenient if submitting the whole form), but if you are using ajax, it just needs to go somewhere that you can grab it.

in a hidden field, or in a meta tag are both very good options.

来源：https://stackoverflow.com/questions/29680409/is-it-a-good-practice-to-store-the-csrf-token-in-meta-tag