I have a REST API which is running in one domain and I have a client in another domain. To prevent CSRF I have configured REST API to accept request originated from client application only. I have added proper encoding as per owasp XSS prevention cheat sheet to prevent any XSS attack on my application. Can I say that my REST API is safe from CSRF attack? Do I even need a synchronizer token to make my API safe?
As per my understanding of CSRF or XSS attack can lead to CSRF attack, as i am preventing both of them, is my application is vulnerable to CSRF?