Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

From a security point of view this is not good. An attacker can embed the logout link wherever (e.g. send a tweet) and logout your users. As said in the parent post, GETs should be idempotent and, in particular, not change any state.


I totally agree. What I'm outlining is that it is very convenient to implement it as a simple anchor tag, hence that is what you usually see in the wild.


Not the libraries' fault if you do something stupid.


That's what tokens are for but I agree that POST is the way to go.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: