Bakkot·14 ปีที่แล้ว·discussCSRF couldn't stop this particular attack, since it's not actually cross-site. You need to guard against both.