I have a front/back applications that needs to be logged in to be used. When I log in (by means of the front-end app sending a request to the back end), what I do is not sending a cookie, but a
JSON with a token in it. The latter will be stored by the front end app in a
sessionstorage and each time it will interact with the back end it will send a request along with the token stored in the
sessionstorage. The back end will verify the validity of the token.
Do you think this solution is CSRF safe? Do you see any other vulnerabilities I'm not considering/ignoring?