Why for logout functionality is needed token?

[Jimmi08]

I understand why you're adding a token to any form, but why a logout link?

This is really a problem... Is there a preference for this to be set off?

How to fix the code like this?

		return "<li class='nav-item dropdown header-profile-dropdown'>
			<a class='nav-link' href='javascript:void(0);' role='button' data-bs-toggle='dropdown' aria-expanded='false'>
				<div class='profile-head d-flex align-items-center gap-2'>
					<span class='fw-medium'>".$name."</span>
					<i class='fi fi-rr-angle-small-down'></i>
				</div>
			</a>
			<div class='dropdown-menu dropdown-menu-end'>
				<a href='".e_BASE."index.php?logout' class='dropdown-item ai-icon'>
					<i class='fi fi-rr-sign-out-alt text-danger'></i>
					<span class='ms-2'>".$tp->toHTML(LAN_AD_LOGOUT)."</span>
				</a>
			</div>
		</li>";

Yes, I found that I can now add a special link in sitelinks, but this is a hardcoded link.

And sometimes there is no logout link in the page content (no signin, no login menu, no navigation link). How to log out now? Only idea I have is to put this on the login.php page somehow, because that is available.

Thanks

[e107help[bot]]

@Jimmi08 Čau Jimako,

In your snippet, add the token to the link, the same way core's own logout links carry it:

<a href='".e_BASE."index.php?logout&amp;e-token=".defset('e_TOKEN')."' class='dropdown-item ai-icon'>

Nothing else in the block changes. The login menu builds its link exactly like that (login_menu_shortcodes.php L299), on 2.3.12 as on master.

Why logout needs one. Anybody can fire a plain index.php?logout. Put it in an image on another site, or in a post on yours, and every member who views that page is logged out. Deltik gave the same reason on #6275.

There's no preference to turn it off.

Pages with no logout link at all. Two routes that need no PHP:

• {CUSTOM=login} in a layout or a menu. A signed-in member gets a short welcome line with Profile, Settings and Logout links, the logout carrying the token; a guest gets a one-line login form (custom.php L31).
• The Logout predefined link you found in Navigation. It arrived after 2.3.12 (Logout as a predefined navigation link, with the {E_TOKEN} placeholder behind it #6305, Logout as a predefined navigation link, with the {E_TOKEN} placeholder behind it #6307), so 2.3.12 itself doesn't have it.

login.php won't help, I'm afraid: a signed-in member who opens it is sent straight on, unless they're a main admin (login.php L15).

I traced all of this in the code rather than trying it on a site.

[Deltik]

@Jimmi08: I'm asking @e107help to demonstrate a logout confirmation page like what Drupal made. This should be more user-friendly than the current implementation, which is this error message:

You have not been logged out, because that link carried no security token. Use the logout link in this site's own menu rather than a bookmark or a link on another site.

The logout CSRF protection is to prevent the nuisance of logging out when the user doesn't intend to. Over the years, major sites have added this form of logout protection, and I believe it is best practice for e107 to do this as well. (For example, Google previously resisted fixing <img src="https://accounts.google.com/Logout">, but they have since patched it after many years.)

[e107help[bot]]

@Jimmi08 @Deltik, the confirmation page is ready for review in #6750.

With that PR, a logout link with no token opens a page asking "Are you sure you want to log out?", with Logout and Cancel. Jana, once it's merged your theme's hard-coded index.php?logout would work again, with one more click, and a forged link would only cost a member a page they can leave. Links that carry the token would still log out straight away, so the snippet from my earlier reply keeps working either way and skips the question.

Jana, three questions for you are in the PR: whether the template's markup suits you to override, whether bootstrap5 should show the page in the centred card it uses for login, and whether the Slovak string is right.

Deltik, three for you: master only or a release/v2.3.x twin as well; whether Cancel goes to the front page, as Drupal's does, or back to the page the member came from; and whether the page's address gets its own constant.

Po slovensky: S týmto PR otvorí odkaz index.php?logout bez tokenu stránku s otázkou „Naozaj sa chcete odhlásiť?“. Keď ho Deltik zlúči, tvoj odkaz v téme bude znova fungovať, len s jedným kliknutím navyše. V PR sú pre teba tri otázky: šablóna, karta v bootstrap5 a slovenský preklad.

[e107help[bot]]

@Jimmi08 @Deltik, #6750 has been rebuilt. With it, the question appears at index.php?logout itself, so no new logout.php file is added, and Cancel takes you back to the page you came from when that page is on this site. Once it is merged, your hard-coded theme link would work again without any change, with one more click.

How pages like this could be built is written up as a proposal in #6752, with a short summary at the top for theme authors. Its one question for theme authors is in point 4 there. The release/v2.3.x version is #6753.

Po slovensky: s #6750 sa otázka zobrazí priamo na adrese index.php?logout, takže netreba nový súbor logout.php, a Zrušiť ťa vráti na stránku, z ktorej si prišla, ak je na tomto webe. Keď sa zlúči, tvoj odkaz v téme bude znova fungovať bez úprav, len s jedným kliknutím navyše. Návrh, ako by sa takéto stránky mohli stavať, je v #6752 a jeho jedna otázka pre autorov tém je v bode 4.

[Jimmi08]

Wow, this is perfect. Thank you