I know they say CSRF tokens are the most secure way to prevent CSRF attacks but what if someone uses XHR to retrieve the page containing the csrf token along with the form and then use that token for his attacks?
Why they don't say "Referer" header is the most secure way to prevent CSRF attacks? Afterall nearly 99% of the currently in-use browsers will provide "Referer" header and the attacker cannot change it in anyway. (Yes, he can't, unless the browser/OS itself is compromised)
Now that I protect my website using "referer" header, do I really need csrf tokens? All my important requests are using POST and not GET method.