title: HttpOnly cookie and XSRF-TOKEN in angular js
body: <p>I have an angular js web application with play framework as server side. I am using Google plus sign-in button to authenticate users. I need to authenticate all my ajax calls in the server side. After going through documentation that's available on the net, I have couple of options and questions on each. </p>
  
  <p>Hook up point: Javascript Google sign in, on successful sign in, calls back a javascript method. The id_token that's returned along with the callback needs to be verified again through the server side as recommended <a href="https://developers.google.com/identity/sign-in/web/backend-auth" rel="nofollow">here</a>. So the above mentioned options can be added at this point on the server side invocation</p>
  
  <ol>
  <li>Use HttpOnly cookie and check it on each ajax call. Can we be assured this will prevent CSRF attacks too ?</li>
  <li>Set a XSRF-TOKEN cookie, however it should be set as HttpOnly = false. Only then angularjs will be able to read it and set it as X-XSRF-TOKEN header in all requests originating from it. Is it safe to expose a javascript readable cookie and later rely on it being secure ?</li>
  </ol>