[sippeangelo]

CSRF tokens solve this problem for free

[jchw]

AFAIK typical CSRF token implementations allow for reuse, and unlike an idempotency token necessarily need to be generated by a trusted server. They solve a different problem.