Logout is accessible via GET, enabling forced-logout attacks #783

ASVS: 3.5.1, 3.5.3 · CWE: CWE-352 · Files: src/asfquart/generics.py (lines 51–58), atr/templates/includes/topnav.html (line 142)

Description

Logout is performed by navigating to GET /auth?logout. Session destruction is a state-changing operation and should not be on a safe HTTP method. An attacker can force logout via <img src="https://target/auth?logout"> on any page, disrupting user workflows.

Vulnerable code

# src/asfquart/generics.py
elif logout_uri or quart.request.query_string == b"logout":
    asfquart.session.clear()  # state change via GET

<!-- topnav.html -->
<a href="/auth?logout=/" class="logout-link btn btn-sm btn-secondary ms-2">Log out</a>

Recommended fix

Require POST for logout and protect with CSRF:

<form method="post" action="/auth/logout" class="d-inline">
    {{ csrf_input|safe }}
    <button type="submit" class="logout-link btn btn-sm btn-secondary ms-2">Log out</button>
</form>