Question: do i need csrf with jwt?
Answer: A JWT, if used without Cookies, negates the need for a CSRF token - BUT! by storing JWT in session/localStorage, your expose your JWT and user's identity if your site has an XSS vulnerability (fairly common). ... Then for csrf protection, verify that the csrf token in the JWT matches the submitted csrf-token header.