I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time.
Through my readings, I've come to learn about:
- The existence of CSRF
- The basics behind it, for both GET and POST requests
- Token and Referer mitigation techniques
- How the Token can be retrieved if the target website hosts an XSS vulnerability
- The fact that the referer is passed in clear text through HTTP headers and could thus be spoofed
- cURL used to load the page first, get the token, and use this one to send the POST data and get page post-auth contents
Hence, my question is the following: if someone uses a PHP script that loads the page hosting the POST form, gets the randomly generated token, and sends the POST data with a custom "Referer" header matching the destination website, is there anything I can do on my server to mitigate this?