Is it a good practice to store the csrf token in meta tag?

Question

If I make a POST request without using form and want to prevent CSRF attack, what I can do is to set the csrf-token in meta tag and put it back to the header when the request is

Answer 1

Yes this is good practice. If you are using ajax I think this is the cleanest solution.

You could also put the token inside of the form (which is more convenient if submitting the whole form), but if you are using ajax, it just needs to go somewhere that you can grab it.

in a hidden field, or in a meta tag are both very good options.