Log Off should use POST #61

New Issue

2026-07-12T19:58:04Z

danieljsummers commented

2026-07-12 19:58:04 +00:00

The log off links currently generated by the Fluid tags and in the admin area use the HTTP GET verb (i.e., a normal link). However, there are several reasons why "log off" should be implemented with POST instead.

GET requests are supposed to be idempotent (they can be called over and over again with the same result). While this could be interpreted as "at the end of the request, there is no logged on user", logging off does change the state of the user's session, and can lead to other GET requests (those that require the user be logged on) returning different (non-idempotent) results.
Browsers and other web accelerators like to pre-fetch links so that they can be displayed more quickly. In this case, pre-fetching "log off" (as a GET) logs the user off in a misguided effort to help them be more productive.

Both the Fluid tag and the admin area should generate a form which submits a POST request to /user/log-off rather than a GET.

The log off links currently generated by the Fluid tags and in the admin area use the HTTP `GET` verb (i.e., a normal link). However, there are several reasons why "log off" should be implemented with `POST` instead. - `GET` requests are supposed to be idempotent (they can be called over and over again with the same result). While this could be interpreted as "at the end of the request, there is no logged on user", logging off does change the state of the user's session, and can lead to other `GET` requests (those that require the user be logged on) returning different (non-idempotent) results. - Browsers and other web accelerators like to pre-fetch links so that they can be displayed more quickly. In this case, pre-fetching "log off" (as a `GET`) logs the user off in a misguided effort to help them be more productive. Both the Fluid tag and the admin area should generate a `form` which submits a `POST` request to `/user/log-off` rather than a `GET`.

danieljsummers added the

labels 2026-07-12 19:58:46 +00:00

danieljsummers added this to the v3 milestone 2026-07-12 19:58:50 +00:00

danieljsummers self-assigned this 2026-07-18 02:29:18 +00:00

danieljsummers referenced this issue from a commit

2026-07-18 02:49:42 +00:00

Change log off to POST (#61)

danieljsummers commented