Mitigations landing for new class of timing attack
I am very curious about Yehuda Katz's question on CSRF attacks and GET requests: <a href="https://twitter.com/wycats/status/948812652997885952" rel="nofollow">https://twitter.com/wycats/status/948812652997885952</a>