Log out with a POST form.

The logout link put the CSRF token in the URL, which goes into logs and the browser history.
2026-09-26 15:27:51 +02:00
parent 061f9c1a37
commit 71f768bff2
5 changed files with 38 additions and 10 deletions
@@ -85,7 +85,9 @@ class FrontPagesTest extends PageTestCase {
    $token = $this->loginAs();
    $body = $this->get('/')['body'];
    $this->assertStringContainsString('Secret', $body);
-    $this->assertStringContainsString('<a href="/publish/logout?token=' . $token . '">Logout</a>', $body);
+    $this->assertStringContainsString('<form action="/publish/logout" method="post"><input type="hidden" name="csrf_token" value="' . $token . '" />'
+                                      . '<button type="submit">Logout</button></form>', $body);
+    $this->assertStringNotContainsString('?token=', $body);
    $this->assertStringContainsString('<a href="/publish/addeditor">Add editor</a>', $body);
  }