&gt; But I don&#x27;t see how a random token is any worse than an incrementing one if you&#x27;re just going to straight up reject requests where the token doesn&#x27;t match.<p>No, random tokens are not worse per se, they just have no place in the algorithm Martin described. It&#x27;s a completely different system. In that system incremental tokens presume a mechanism that gives you a way to have some order of events. And one can rely on that order to decide which requests with which tokens to reject.