MIME-Version: 1.0
References: <f7e8e47d-7485-4b07-9f8a-1bc9ec08d006@app.fastmail.com>
 <C6C400C3-138B-4AAD-B876-41CBE0CD0C8B@yesql.se>
 <4aec458a-547d-42c5-9576-5f105694b035@app.fastmail.com>
In-Reply-To: <4aec458a-547d-42c5-9576-5f105694b035@app.fastmail.com>
From: Magnus Hagander <magnus@hagander.net>
Date: Fri, 20 Mar 2026 19:26:10 +0100
Message-ID: 
 <CABUevEzeBgmCaAnEy6jKh7viS5Ptuzi5i-sse01G8xE4XLtZfA@mail.gmail.com>
Subject: Re: Unable to log out of postgresql.org
To: Jack Bonatakis <jack@bonatak.is>
Cc: Daniel Gustafsson <daniel@yesql.se>, pgsql-www@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000086736d064d78d2aa"
Archived-At: 
 <https://www.postgresql.org/message-id/CABUevEzeBgmCaAnEy6jKh7viS5Ptuzi5i-sse01G8xE4XLtZfA%40mail.gmail.com>
Precedence: bulk

--00000000000086736d064d78d2aa
Content-Type: text/plain; charset="UTF-8"

Nice spot.

However, this fix won't work. Putting a csrf token on every page is
incompatible with the caching system we have in place.

One way to fix it would be to just allow logout GET again (I think this got
broken on a django upgrade where it wasn't tested). But maybe the better
way to fix it would be to have the logout link go to a page with a POST
form on it, and have that form do what the GET link does now. I assume the
GET is blocked because otherwise someone could trick a user, or redirect
them, to the logout URL and they get logged out. I'm not sure how realistic
or how big of a problem that is, but getting rid of it would not hurt...

Would you be interested in working on a patch for that as well?

//Magnus


On Fri, 20 Mar 2026 at 00:49, Jack Bonatakis <jack@bonatak.is> wrote:

> Hi Daniel,
>
> Thanks for confirming. I took a look at the repo and have a fix that works
> locally. Please see the attached patch.
>
> Jack
>
> On Thu, Mar 19, 2026, at 6:21 PM, Daniel Gustafsson wrote:
>
> > On 19 Mar 2026, at 23:15, Jack Bonatakis <jack@bonatak.is> wrote:
>
> > I seem unable to log out of postgresql.org. I have tried in multiple
> browsers and have received the same error each time.
>
> I can reproduce that as well.
>
> --
> Daniel Gustafsson
>
>
>
>

--00000000000086736d064d78d2aa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Nice spot.</div><div dir=3D"ltr"><br></di=
v><div>However, this fix won&#39;t work. Putting a csrf token on every page=
 is incompatible with the caching system we have in place.</div><div><br></=
div><div>One way to fix it would be to just allow logout GET again (I think=
 this got broken on a django upgrade where it wasn&#39;t tested). But maybe=
 the better way to fix it would be to have the logout link go to a page wit=
h a POST form on it, and have that form do what the GET link does now.=C2=
=A0I assume the GET is blocked because otherwise someone could trick a user=
, or redirect them, to the logout URL and they get logged out. I&#39;m not =
sure how realistic or how big of a problem that is, but getting rid of it w=
ould not hurt...</div><div><br></div><div>Would you be interested in workin=
g=C2=A0on a patch for that as well?</div><div><br></div><div>//Magnus</div>=
<div><br></div><div><br></div><div dir=3D"ltr">On Fri, 20 Mar 2026 at 00:49=
, Jack Bonatakis &lt;<a href=3D"mailto:jack@bonatak.is">jack@bonatak.is</a>=
&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_container"><blockquo=
te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex"><u></u><div><div>Hi Daniel,</div><=
div><br></div><div>Thanks for confirming. I took a look at the repo and hav=
e a fix that works locally. Please see the attached patch.</div><div><br></=
div><div>Jack</div><div><br></div><div>On Thu, Mar 19, 2026, at 6:21 PM, Da=
niel Gustafsson wrote:</div><blockquote type=3D"cite" id=3D"m_-837542999312=
9916949qt"><div>&gt; On 19 Mar 2026, at 23:15, Jack Bonatakis &lt;<a href=
=3D"mailto:jack@bonatak.is" target=3D"_blank">jack@bonatak.is</a>&gt; wrote=
:</div><div><br></div><div>&gt; I seem unable to log out of=C2=A0<a href=3D=
"http://postgresql.org" target=3D"_blank">postgresql.org</a>. I have tried =
in multiple browsers and have received the same error each time.</div><div>=
<br></div><div>I can reproduce that as well.</div><div><br></div><div>--</d=
iv><div>Daniel Gustafsson</div><div><br></div><div><br></div></blockquote><=
div><br></div></div></blockquote></div><div><br></div><div dir=3D"ltr" clas=
s=3D"gmail_signature"><div dir=3D"ltr"></div></div></div>

--00000000000086736d064d78d2aa--