title: CSRF token and XSS vulnerability
body: <p>Let's say that we use a CSRF token in our forms, but it happens that there is an unnoticed XSS hole on our site.</p>
  
  <p>From what I uderstand, CSRF token protection is completely void in this case, because attacker can retreive it with XMLHttpRequest through XSS. </p>
  
  <p>In such case, is there a way to enchant the CSRF protection in a way that it would survive the attack or should our site first have a secure anti-XSS protection before doing any king of CSRF at all?</p>
  
  <p>Setting a new token upon every page request instead of token on login would deal with it? This brings up the problem of having more forms open at once and I don't like it.</p>