But the window of opportunity is dramatically reduced if you can only launch your attack while the user is actively using the victim's site. It's the same reas

But the window of opportunity is dramatically reduced if you can only launch your attack while the user is actively using the victim's site. It's the same reason OAuth uses expiring tokens. If you think that doesn't help and you're surely smarter than the whole security community who has been developing these standards for decades, please write a specification yourself and let us review it to see how great that is.