I'm currently in the process of implementing CSRF protection into my framework (PHP).
However I am wondering:
Wouldn't it be possible for an attacker to load my page in a (hidden) iframe (obtaining the token) and change some data using JavaScript?
And after that submitting the form?