While I agree that you should include a one-time token with all sensitive forms, I don't think that disabling links/submit buttons on the first click is a bad i

While I agree that you should include a one-time token with all sensitive forms, I don't think that disabling links/submit buttons on the first click is a bad idea in general. It's an easy fix that will immediately prevent most accidental redundant server requests, but as it's a client-side fix it's inherently unreliable. What's wrong though is the author's solution of disabling _all_ links and submit buttons on the page indefinitely. Here's an alternative solution that only disables whatever has been clicked on for half a second: (function() { function stopClickEvent (ev) { ev.preventDefault(); ev.stopPropagation(); } document.body.addEventListener('click', function (ev) { if (ev.target.tagName === 'A' || ev.target.getAttribute('type').toLowerCase() === 'submit') { setTimeout(function () { // Needs to happen _after_ the request goes through, hence the timeout ev.target.addEventListener('click', stopClickEvent); }, 0); setTimeout(function () { ev.target.removeEventListener('click', stopClickEvent); }, 500); } }); })(); Unlike the author's solution, this really works for links (they don't support the `disabled` attribute), it doesn't change the appearance of the button, it only disables one element, and it will work for elements that have been added to the document after the DOM was loaded. You can try it here: http://codepen.io/anon/pen/xGKdLX http://codepen.io/anon/pen/xGKdLX