public inbox for [email protected]
help / color / mirror / Atom feedFrom: Magnus Hagander <[email protected]>
To: Jack Bonatakis <[email protected]>
Cc: Daniel Gustafsson <[email protected]>
Cc: [email protected]
Subject: Re: Unable to log out of postgresql.org
Date: Fri, 20 Mar 2026 19:26:10 +0100
Message-ID: <CABUevEzeBgmCaAnEy6jKh7viS5Ptuzi5i-sse01G8xE4XLtZfA@mail.gmail.com> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
<[email protected]>
<[email protected]>
Nice spot.
However, this fix won't work. Putting a csrf token on every page is
incompatible with the caching system we have in place.
One way to fix it would be to just allow logout GET again (I think this got
broken on a django upgrade where it wasn't tested). But maybe the better
way to fix it would be to have the logout link go to a page with a POST
form on it, and have that form do what the GET link does now. I assume the
GET is blocked because otherwise someone could trick a user, or redirect
them, to the logout URL and they get logged out. I'm not sure how realistic
or how big of a problem that is, but getting rid of it would not hurt...
Would you be interested in working on a patch for that as well?
//Magnus
On Fri, 20 Mar 2026 at 00:49, Jack Bonatakis <[email protected]> wrote:
> Hi Daniel,
>
> Thanks for confirming. I took a look at the repo and have a fix that works
> locally. Please see the attached patch.
>
> Jack
>
> On Thu, Mar 19, 2026, at 6:21 PM, Daniel Gustafsson wrote:
>
> > On 19 Mar 2026, at 23:15, Jack Bonatakis <[email protected]> wrote:
>
> > I seem unable to log out of postgresql.org. I have tried in multiple
> browsers and have received the same error each time.
>
> I can reproduce that as well.
>
> --
> Daniel Gustafsson
>
>
>
>
view thread (6+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected], [email protected]
Subject: Re: Unable to log out of postgresql.org
In-Reply-To: <CABUevEzeBgmCaAnEy6jKh7viS5Ptuzi5i-sse01G8xE4XLtZfA@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox