2 ms·

No, it wasn’t. It’s not validating reused codes or tokens from an application owned by attacker.

• 29athrowaway 3y ago
  True, thanks for noticing. I re-read it more carefully