There are a lot of attack vectors to defend against in a modern web application, far too many to cover in depth here.
But here are a couple of high-level points to consider:
To avoid attacks like CSRF, you should also ensure that every new request coming in is linked to an existing user interaction (e.g. using anti-CSRF tokens), not coming in "out of the blue".
Some clients will have compromised their own security (e.g. by installing sketchy browser extensions from who knows where) and you can never defeat those entirely, although in some cases you can detect them. Neither is it really your place to defeat those: if a user has malware on their own device that's really their problem and not yours -- your primary defense against that is the first point above: don't trust the client side code.
Also, all of the above assumes that attackers have no access to your server systems. That's crucial: the only way traffic from the outside world should be able to reach your production servers is by ports you've explicitly opened to the internet (these days, port 80 and 443) and by whatever administration mechanism you use (which should ideally be protected by a strong cryptographic mechanism, e.g. SSH public key authentication, not simply by passwords). Your server-side systems should be kept up to date with all security patches and ideally should be vetted by a competent security professional to ensure there aren't any other vulnerabilities you don't know about.
Finally: all of this is an ongoing process. Today's web is filled with drive-by attackers. You should expect that maintaining and protecting your application will be an ongoing cost, not only in terms of money but also in time and energy.