Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why does Laravel, by default, logout via POST (As opposed to GET)? [duplicate]

Within the context of a Laravel application, what is the significance of POSTing to perform a logout? Is there some security and/or session particularity that POSTing over just GETing?

The relevant portion from the generated make::auth:

<ul class="dropdown-menu" role="menu">
  <li>
    <a
      href="{{ url('/logout') }}"
      onclick="event.preventDefault();document.getElementById('logout-form').submit();">
      Logout
    </a>

    <form id="logout-form" action="{{ url('/logout') }}" method="POST" style="display: none;">
      {{ csrf_field() }}
    </form>
  </li>
</ul>
like image 326
Chris Avatar asked Aug 05 '16 13:08

Chris


1 Answers

GET requests are supposed to be "safe" and shouldn't have any significant side effects. It shouldn't matter, for example, if a precaching feature of a browser followed the link. That should just get some data.

Logging the user out would be a significant side effect, so GET would be inappropriate.

like image 184
Quentin Avatar answered Nov 16 '22 15:11

Quentin