This is tricky - it's up to the site basically. For single site websites (hacker news, let's say) then yeah - samesite should be enabled to prevent this. For a

This is tricky - it's up to the site basically. For single site websites (hacker news, let's say) then yeah - samesite should be enabled to prevent this. For a large IDP like Google, Facebook, Microsoft, etc, you start to want* logout via cross-site requests, but it needs to be protected against DoS attacks like the link provided. So you need some other proof that the requesting site has a session - a session ID, an ID token, a unique identifier for one of the users in session (this is the least bulletproof one). * well, standards wise at least. Google doesn't document a logout url anymore.