Using proper cookie flags can also mitigate this. I am not sure there is a reason to have the session cookie accessible via JS. HttpOnly flag alone could have helped here.

If by location you mean IP address, the XSS script could also send the IP address of the user to the attacker. Then the attacker could do write operations spoofing that IP. They wouldn't get a response but the write operation would be done anyways.

Maybe doing a 3 way handshake before every administrative action to ensure the IP wasn't spoofed? Idk, I'm not a security person.

1. User sends IP and JWT + administrative action. I mean, IP is extracted from src addr, not sent.

2. Server saves the command in a cache with a TTL of 10 seconds. Then sends a randomly generated string to the user. The random string is sent in A HTTP-only same-site cookie to avoid it being read by JS scripts or being sent to external domains.

3. The user sends it's JWT + randomly generated string cookie back to the server. The server checks the cache. If an action is found, it is executed.

Edit: actually, after thinking about it. If the XSS is not sending the JWT to a remote location but running the attack directly in the victim's browser, there's nothing that can be done. XSS is fucked up.