I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question.
I have not used CodeIgniter as a programmer, but I have recently performed a penetration testing for a website that was using it. The site was very AJAX-heavy and as far as I understood it, it had CSRF protection in the form of a cookie (not marked httponly) that is copied into a hidden field of a form right before the form is submitted.
This automatically means if an attacker can find an XSS vulnerability in the website (as was the case), he can leverage it to achieve CSRF, too.
However, assuming the site is clear of XSS, is this solution inherently safe?
I suppose that you cannot assume invulnerability to XSS as a defense, but still, is there any other attack on this (that does not leverage XSS)?