> But I don't see how a random token is any worse than an incrementing one if you're just going to straight up reject requests where the token doesn't match. N

> But I don't see how a random token is any worse than an incrementing one if you're just going to straight up reject requests where the token doesn't match. No, random tokens are not worse per se, they just have no place in the algorithm Martin described. It's a completely different system. In that system incremental tokens presume a mechanism that gives you a way to have some order of events. And one can rely on that order to decide which requests with which tokens to reject.