title: CSRF - Is it safe to ask it with api call?
body: <p>I'm using session based CSRF on a site using Angular. Is it safe to make an HTTP call to ask for the CSRF token? </p>
  
  <p>For example, if I sent a request with valid user session to a page called /csrf/get and it prints a raw token, is this secure enough for CSRF functionality? If not, is there anything I can do to make it more secure while keeping the JSON retrieval functionality?</p>
  
  <p>It will be the first api call before everything else and I will keep it on localstorage to use it on every http call</p>