How to implement CSRF protection in a SPA application?

Question

HTTP Cookies

Hello.
On the SPA front, in the Vue.js + Vuex + Websocket bundle
, JWT access/refresh tokens are selected as sessions. Tokens are stored in cookies with the http only and secure flag.
My version, which currently works, but I have doubts :)

We generate a csrf token for each request from the client to api, write the token as a key in memcached, and csrf as a value. After that, via websocket we send our token to all socket.id of the user. Those, in turn, set a new token in Vuex and sign every API request with it. On the api side, we check csrf and if something is wrong, we give an error.

How is it possible to protect the client from csrf and xss attacks in the SPA application to the maximum? And does my option have the right to life? Have I learned everything? Thank you very much for your reply.