The form should indeed include single-use tokens to allow server-side filtering of duplicates. Related: https://en.wikipedia.org/wiki/Replay_attack https://en.

The form should indeed include single-use tokens to allow server-side filtering of duplicates. Related: https://en.wikipedia.org/wiki/Replay_attack https://en.wikipedia.org/wiki/Replay_attack