Feedback-ID: iecce486f:Fastmail
MIME-Version: 1.0
Date: Fri, 20 Mar 2026 21:51:32 -0400
From: "Jack Bonatakis" <jack@bonatak.is>
To: "Magnus Hagander" <magnus@hagander.net>
Cc: pgsql-www@lists.postgresql.org
Message-Id: <8448e79d-3359-4c83-9913-0812df7b5a8a@app.fastmail.com>
In-Reply-To: 
 <CABUevEzeBgmCaAnEy6jKh7viS5Ptuzi5i-sse01G8xE4XLtZfA@mail.gmail.com>
References: <f7e8e47d-7485-4b07-9f8a-1bc9ec08d006@app.fastmail.com>
 <C6C400C3-138B-4AAD-B876-41CBE0CD0C8B@yesql.se>
 <4aec458a-547d-42c5-9576-5f105694b035@app.fastmail.com>
 <CABUevEzeBgmCaAnEy6jKh7viS5Ptuzi5i-sse01G8xE4XLtZfA@mail.gmail.com>
Subject: Re: Unable to log out of postgresql.org
Content-Type: multipart/alternative;
 boundary=7b1863c5b32147fda517b27cc01c1a10
Archived-At: 
 <https://www.postgresql.org/message-id/8448e79d-3359-4c83-9913-0812df7b5a8a%40app.fastmail.com>
Precedence: bulk

--7b1863c5b32147fda517b27cc01c1a10
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

On Fri, Mar 20, 2026, at 2:26 PM, Magnus Hagander wrote:
> Nice spot.
> 
> However, this fix won't work. Putting a csrf token on every page is incompatible with the caching system we have in place.
> 
> One way to fix it would be to just allow logout GET again (I think this got broken on a django upgrade where it wasn't tested). But maybe the better way to fix it would be to have the logout link go to a page with a POST form on it, and have that form do what the GET link does now. I assume the GET is blocked because otherwise someone could trick a user, or redirect them, to the logout URL and they get logged out. I'm not sure how realistic or how big of a problem that is, but getting rid of it would not hurt...
> 
> Would you be interested in working on a patch for that as well?
> 
> //Magnus

Ah interesting. Yeah, it looks to be a change new with Django 5. I'll have to take a closer look at the existing caching system, but yes I'd be happy to work on an alternative to my patch above. Your proposal seems reasonable and might be the way to go.

Jack 
--7b1863c5b32147fda517b27cc01c1a10
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title></head><body><div>On Fri, Mar =
20, 2026, at 2:26 PM, Magnus Hagander wrote:</div><blockquote type=3D"ci=
te" id=3D"qt" style=3D""><div dir=3D"ltr"><div dir=3D"ltr">Nice spot.</d=
iv><div dir=3D"ltr"><br></div><div>However, this fix won't work. Putting=
 a csrf token on every page is incompatible with the caching system we h=
ave in place.</div><div><br></div><div>One way to fix it would be to jus=
t allow logout GET again (I think this got broken on a django upgrade wh=
ere it wasn't tested). But maybe the better way to fix it would be to ha=
ve the logout link go to a page with a POST form on it, and have that fo=
rm do what the GET link does now.&nbsp;I assume the GET is blocked becau=
se otherwise someone could trick a user, or redirect them, to the logout=
 URL and they get logged out. I'm not sure how realistic or how big of a=
 problem that is, but getting rid of it would not hurt...</div><div><br>=
</div><div>Would you be interested in working&nbsp;on a patch for that a=
s well?</div><div><br></div><div>//Magnus<br></div></div></blockquote><d=
iv><br></div><div>Ah interesting. Yeah, it looks to be a change new with=
 Django 5. I'll have to take a closer look at the existing caching syste=
m, but yes I'd be happy to work on an alternative to my patch above. You=
r proposal seems reasonable and might be the way to go.<br></div><div><b=
r></div><div>Jack&nbsp;</div></body></html>
--7b1863c5b32147fda517b27cc01c1a10--