CSRF and double posting

Here's something pedantic: JS and DOM aren't single-threaded, and the latter is not even a relevant term. Browser implementations may be single-threaded - that's a different thing.

Every major browser we have today paints the DOM in a single blocking thread. Sending a synchronous AJAX call blocks this thread. You literally cannot click another link on the page while a request is in progress. From a UX perspective this is a very poor design and that's the reason it's being removed from the spec. If a request takes 1-2s you've locked the entire page for that duration. That's not my idea of "how it works best" and they're removing it to stop people from using it this way.

Web workers are the only way to multi-thread JS and they don't have DOM access which is how they achieve this. Node is also single threaded but it's event loop is non blocking unless you use synchronous methods.

Obviously we don't see eye to eye on this subject. CSRF protection is only one security measure and you should implement multiple to protect yourself. I didn't mean to say CSRF is the only protection you need and you should disable settings willy nilly. It works best in tandem with others which is why I mentioned the iframe block. Apparently I've done a poor job of explaining myself so I'll duck out of this thread now.