3 ms·

I think what he's saying is if your CSRF protection is based on a nonce, this vulnerability doesn't break it.