From a8789a6c41c3908651266daf0366b501c5df2934 Mon Sep 17 00:00:00 2001
From: Birger Schacht <birger.schacht@oeaw.ac.at>
Date: Wed, 18 Sep 2024 08:27:13 +0200
Subject: [PATCH] fix(core): replace logout link with a logout form

The Django logout system only works if a POST request with the correct
`csrf_token` is sent to the `logout` route. The previously existing link
to the `logout` route simply did not work.

Closes: #910
---
 apis_core/core/templates/base.html | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/apis_core/core/templates/base.html b/apis_core/core/templates/base.html
index d62187b10..927031f99 100644
--- a/apis_core/core/templates/base.html
+++ b/apis_core/core/templates/base.html
@@ -143,10 +143,13 @@
                        aria-expanded="false">User: {{ user.get_username }}</a>
                     <div class="dropdown-menu dropdown-menu-right">
                       <div class="dropdown-item">
-                        <a class="nav-link p-0" href="{% url 'apis_core:logout' %}?next=/">
-                          <span class="material-symbols-outlined">logout</span>
-                          log out
-                        </a>
+                        <form action="{% url 'apis_core:logout' %}" method="post">
+                          {% csrf_token %}
+                          <button type="submit" class="btn">
+                            <span class="material-symbols-outlined material-symbols-align">logout</span>
+                            log out
+                          </button>
+                        </form>
                       </div>
                     </div>
                   </li>