If a website uses XHR for all POST requests and the server checks CORS correctly, could it still be under CSRF danger?
<p>Say that there is a website, it </p>

<ol>
<li><p>uses XHR for all of its POST request and only POST requests could trigger write operation on the server.</p></li>
<li><p>the server also has proper CORS config, that it does not accept any request but its own</p></li>
</ol>

<p>Then is it possible for this website to still be under potential danger of CSRF?</p>