This is still vulnerable to the same kinds of attacks you can do with login CSRF: http://seclab.stanford.edu/websec/csrf/csrf.pdf http://seclab.stanford.edu/web

This is still vulnerable to the same kinds of attacks you can do with login CSRF: http://seclab.stanford.edu/websec/csrf/csrf.pdf http://seclab.stanford.edu/websec/csrf/csrf.pdf Though the attack scenarios for that are always very tenuous.