Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option in settings to use either GET or POST on logouts #133

Open
9mido opened this issue Feb 9, 2020 · 0 comments
Open

Add option in settings to use either GET or POST on logouts #133

9mido opened this issue Feb 9, 2020 · 0 comments

Comments

@9mido
Copy link

9mido commented Feb 9, 2020

This github project currently uses GET to logout the user from their session. This may be convenient, but may not be the best approach and might actually be 'dangerous' as the server may not realize that the user has logged out.

https://softwareengineering.stackexchange.com/questions/188860/why-shouldnt-a-get-request-change-data-on-the-server
https://stackoverflow.com/questions/3521290/logout-get-or-post
https://code.djangoproject.com/ticket/15619
https://readthedocs.org/projects/django-allauth/downloads/pdf/latest/ (see section 4.3 configuration ACCOUNT_LOGOUT_ON_GET)

I recommend either changing this project to use POST completely or provide the user the option to use either POST or GET in their settings.

Maybe also include a way to automatically navigate to /accounts/logout/ in allauth for example and click the sign out button which in my project is using POST to logout because the user physically clicks the logout button and this change gets POSTed to the server so that the server is on the same page as the client.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant