3 ms·
From a security point of view this is not good. An attacker can embed the logout link wherever (e.g. send a tweet) and logout your users. As said in the parent
by ecesena 13y ago
From a security point of view this is not good. An attacker can embed the logout link wherever (e.g. send a tweet) and logout your users. As said in the parent post, GETs should be idempotent and, in particular, not change any state.
- yogo 13y agoI totally agree. What I'm outlining is that it is very convenient to implement it as a simple anchor tag, hence that is what you usually see in the wild.
- bpicolo 13y agoNot the libraries' fault if you do something stupid.
- hnha 13y agoThat's what tokens are for but I agree that POST is the way to go.