Log out with a POST form.

The logout link put the CSRF token in the URL, which goes into logs and the browser history.
2026-09-26 15:27:51 +02:00
parent 061f9c1a37
commit 71f768bff2
5 changed files with 38 additions and 10 deletions
@@ -29,7 +29,8 @@ if (preg_match("#^(/$|/index|/article)#", $_SERVER['REQUEST_URI'])) {
      <li><a href="/publish">Add</a>/<a href="/publish/edit" class="sidelink">Edit</a></li>
 <?php if (isset($is_admin) && $is_admin) {
        echo '      <li><a href="/publish/addeditor">Add editor</a></li>'."\n";
-        echo '      <li><a href="/publish/logout?token='.csrf_token().'">Logout</a></li>'."\n";
+        // A form, so that the token stays out of the URL
+        echo '      <li><form action="/publish/logout" method="post">'.csrf_field().'<button type="submit">Logout</button></form></li>'."\n";
 }
      //echo '      <li><a href="/policy">Publishing policy</a></li>';
      ?>