FlexMeasures / flexmeasures / 36264051741

85%

push

github

Log out through a POST form (#2604)

* Log out through a POST form, so logout needs no GET

The UI logged out through a plain link, i.e. a GET request, so any other
site could log a user out by linking to /logout, e.g. in an image tag.
Flask-Security 5.9 only allows logging out by POST by default, but we
had kept GET allowed (SECURITY_LOGOUT_METHODS) for that link.

The "Log out" button is now a POST form, and SECURITY_LOGOUT_METHODS is
gone, so Flask-Security's default applies: POST only as of 5.9, while 5.8
(which Python 3.10 still gets) keeps allowing GET as well.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PZsZTwYKqi3NBS2EfQVZMU
Signed-off-by: F.N. Claessen <felix@seita.nl>

* Add changelog entry for PR #2604

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PZsZTwYKqi3NBS2EfQVZMU
Signed-off-by: F.N. Claessen <felix@seita.nl>

* Only allow logging out by POST on Flask-Security 5.8, too

Without the setting, Flask-Security 5.8, which Python 3.10 still gets, would keep allowing GET, leaving the cross-site logout open there. SECURITY_LOGOUT_METHODS is now set to 5.9's own default, POST only, so the test for it no longer needs to skip 5.8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PZsZTwYKqi3NBS2EfQVZMU
Signed-off-by: F.N. Claessen <felix@seita.nl>

* Say that logging out redirects

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PZsZTwYKqi3NBS2EfQVZMU
Signed-off-by: F.N. Claessen <felix@seita.nl>

* Keep the Log out button aligned with its neighbour

Wrapped in a form, the Log out button no longer lined up with Reset
password (reported in review): its height of 100% now referred to the
form, which has no height of its own, and a global rule gives every
submit button a top margin of 6px.

The logout form now has an a... (continued)

1 of 1 new or added line in 1 file covered. (100.0%)

20579 of 23906 relevant lines covered (86.08%)

0.86 hits per line