Where to store you JWT cookies - JWT token must be retrieved from back end as Cookie header with HttpOnly and Secure flags for avoiding XSS (it only applies when storing JWT token in localStorage/sessionStorage) As Cookie will be stored in sessionStorage and because of HttpOnly JavaScript will not be able to access it. XSS applies when hackish Javascript is injected in your site. Because JavaScript can not read it, we are safe :)
Where to store you JWT cookies - JWT token, for avoiding CSRF, requires random token provided from back end as Cookie. This random token could be included in the JWT payload or in some HTTP header like X-XSRF-TOKEN for being sent to back end (it only applies when storing JWT token in localStorage/sessionStorage) As Cookie will be stored in sessionStorage and because only code that runs in my domain can read the cookie we are safe. CSRF applies when from some different domain some one tries to send some order to my site by means of for example POST to my site. Because this POST came from a different domain my Cookie will not be sent and we are safe :) Remenber, cookies apply for domain.
AngularJs - AngularJs CSRF protection. It uses random token provided from back end (as Cookie header with HttpOnly and Secure flags) This random token is sent to back end in HTTP header X-XSRF-TOKEN. Code from a different domain will not be able to send my cookie because this code is not able to see Cookie set for my domain/site.
RFC 7231: return 302. Found, moved temporarily. The target resource resides temporarily under a different URI - RFC 7231: the redirection might be altered on occasion, the client ought to continue to use the effective request URI for future requests. For historical reasons, a user agent MAY (even if RFC wasn't originally intended to behave like this) change the request method from POST to GET for the subsequent request. If this behavior is undesired, the 307 (Temporary Redirect) status code can be used instead
RFC 7231: return 201, success with body and links - RFC 7231: return 201 when success after POST,PUT and body in response. With links in reponse. Links to new resource in the reponse's Location header.