I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for objects.
Authentication is token based in which token dynamically added to header using JS functions to prevent CSRF attack. All the functions when interacting with user input data has sanitizers to prevent XSS attack. So basically every valid action has an associated JS function associated with it with XSS and CSRF protection enabled.
What if a user want's to bypass these functions and run his own functions from the console performing the same actions without XSS protections. One option is to implement server side XSS protection.
Now what if someone tries to trick users to paste some JS code in console which essentially has access to authentication tokens and can perform undesired requests which can harm the user. How to mitigate this attack or is there a way to prevent or identify such actions?