Need for CSRF protection that withstands an XSS attack
One of the big dangers of XSS is that it can often bypass CSRF protection and thus perform any action the victim can perform.
If it would be possible to prevent CSRF even if an XSS vulnerability exists, it seems that that would greatly mitigate the damage XSS can do. Because of httpOnly, it may not be possible to steal cookies, which would leave an attacker with phishing attacks, defacement , and reading out data that is accessible to the client.
But OWASP says that it is not possible to prevent CSRF once an XSS vulnerability exists.
Using referrer check for proper CSRF protection?
Shouldn't it be possible to use referrer checks as CSRF protection which work even if an XSS vulnerability exists?
Of course a domain check would not be enough. But wouldn't it work if the exact script is checked?
For example, if a request is sent from
http://example.com/add-user.php, it would be required that the referrer is
- Referrer checks may not always be practical (for example, because the client doesn't send referrers), but if they are used, could they be used in such a way?
- If they can be used like this, are there major downsides to this approach?
- If not, could there theoretically be a CSRF protection that works if an XSS vulnerability exists?