And it also only includes tokens that are short enough to be bruteforced, essentially in JavaScript. And it would only work for tokens that haven't already exp

And it also only includes tokens that are short enough to be bruteforced, essentially in JavaScript. And it would only work for tokens that haven't already expired (isn't it pretty common practice to only let a token be used once?). All in all, it seems like most developers who know enough security to try to stop CSRF with tokens in the first place would create an implementation where the hack is useless. Still an interesting idea though.