7 ms·
In theory yes, but I'd wager that most of the time logouts are just hyperlink (/account/signout, /logout, etc.). Unless you had a good reason to, you kinda have
by yogo 13y ago
In theory yes, but I'd wager that most of the time logouts are just hyperlink (/account/signout, /logout, etc.). Unless you had a good reason to, you kinda have to go out of your way to make it a POST.
- ecesena 13y agoFrom a security point of view this is not good. An attacker can embed the logout link wherever (e.g. send a tweet) and logout your users. As said in the parent post, GETs should be idempotent and, in particular, not change any state.
- yogo 13y agoI totally agree. What I'm outlining is that it is very convenient to implement it as a simple anchor tag, hence that is what you usually see in the wild.
- bpicolo 13y agoNot the libraries' fault if you do something stupid.
- hnha 13y agoThat's what tokens are for but I agree that POST is the way to go.
- adambard 13y agoI feel using a library like this would constitute a good reason.
- windsurfer 13y agoSo you're saying that poorly-designed applications wouldn't work properly sometimes.
- mherkender 13y agoPoorly designed applications like this one? https://accounts.google.com/Logout https://accounts.google.com/Logout
- jodrellblank 13y agoYes. What's your point? Google must be incapable of poor design? Everything a big company does is good?
- mherkender 13y agoI wanted to know what HN consensus was on this sort of thing, because it seems to me this is not something that inexperienced programmers do (like SQL injection). Also, full disclosure: I work for Google.
- windsurfer 13y agoYes. Imagine if everyone put the following code on their sites: <iframe src="https://accounts.google.com/Logout" width="0" height="0" ></iframe>
- snikch 13y agoI believe that would be the point of <meta http-equiv="X-Frame-Options" content="deny">
- codygman 13y agoThat's like trying to duct tape your arm back on after losing a fight with a chainsaw.
- mike-cardwell 13y ago<img src="https://accounts.google.com/Logout" https://accounts.google.com/Logout" style="display:none"> "X-Frame-Options" is used to defend against click-jacking attacks, not to defend against CSRF.