title: JWT + cookies + HTTPS + CSRF
body: <p>I already worked with JWT on mobile app but I will implement it on a website for the first time for the authentication and I have a little thing I still didn't understood :</p>
  
  <ul>
  <li>if I use JWT token with localStorage, XSS attacks are possible</li>
  <li>if I use JWT token with cookies, CRSF attacks are possible</li>
  </ul>
  
  <p>..., but if I use JWT token over HTTPS with httpOnly+secure cookies and a token lifetime of 1 month, are CSRF attacks still possible in this case ?</p>
  
  <p>I see all over the web for custom token with cookie or custom token with localStorage or JWT but I didn't explicitly get the answer of httpOnly+secure cookie + JWT + HTTPS + the need of CSRF.</p>