Turn logout link into a POST API call with refresh
It's better to get rid of any GET request with csrf token
Gerrit patch set: https://gerrit.wikimedia.org/r/506386
See related: T25227
Description
Description
Details
Details
| Project | Branch | Lines +/- | Subject | |
|---|---|---|---|---|
| mediawiki/core | master | +11 -1 | [WIP] Use POST for logout | |
| mediawiki/core | master | +60 -46 | Deprecate logout token on GET |
Related Objects
Related Objects
- Mentioned In
- T324638: Logging-out via sticky header and user menu without confirm step on Special:UserLogout
T305031: Error when logging out via API
T232734: Mobile logout should not involve an interstitial
T25227: Use token when logging out - Mentioned Here
- T246350: SAML logout does not work both ways
T232734: Mobile logout should not involve an interstitial
T25227: Use token when logging out
Event Timeline
Comment Actions
Change 511081 had a related patch set uploaded (by Fomafix; owner: Fomafix):
[mediawiki/core@master] [WIP] Use POST for logout
Comment Actions
Change 511310 had a related patch set uploaded (by Ladsgroup; owner: Ladsgroup):
[mediawiki/core@master] Deprecate logout token on GET
Comment Actions
Change 511310 merged by jenkins-bot:
[mediawiki/core@master] Deprecate logout token on GET
Comment Actions
@Ladsgroup If I visit Special:UserLogout directly, I only see text "Do you want to log out?" and no button or link to do anything.
Comment Actions
It works in beta as expected:
- https://en.wikipedia.beta.wmflabs.org/w/index.php?title=Special:UserLogout&returnto=Main+Page
- https://en.wikipedia.beta.wmflabs.org/w/index.php?title=Special:UserLogout
Where are you testing this?
Comment Actions
Translatewiki.net. Looks like it caught some revision in between where there isn't a button, but the link text was already removed.
Comment Actions
Seems like the same thing doesn't work in the mobile interface - T232734: Mobile logout should not involve an interstitial
Comment Actions
This causes problems for SAML auth. See https://phabricator.wikimedia.org/T246350 and https://www.mediawiki.org/w/index.php?title=Topic:W5nyw48nx1pc2lsy
Comment Actions
If the issue is SAML specific, the extension should just provide an endpoint to call for logout.
Comment Actions
I don't think we'd want to revert this change, as we'd lose at least a modest bit of security protection.
Comment Actions
Also, I doubt it would help, T25227: Use token when logging out would probably break SAML logouts with or without POST. And we do want to have some kind of CSRF protection for logouts. Especially while we publish IP addresses for anonymous actions, third-party-initiated stealth logout can be abused to dox users.