Tickets :: Comment on [#8331] shall we need a token for logout?

* Your Email Address
* Spam protection	Enter the letters below: .___. ..__ .__.. , \| \|[__)[__] \./ \| \__\|\| \\| \| \|
Comment	>> By doing this your users can be logged out by someone who includes an > >> image in an email pointing to a logout link. It's a denial of service > >> type of attack. > > > > Yes I know, but it's not properly speaking a denial of service. > Should be rare. > > > > I'll be obliged to leave with my patch and some others colleagues > without tokens! (bad idea..) Even if a CAS SSO server is able to know > which service has been used, it will have no idea of the token to > logout a user. We can just say: for that service, use that URL. > > > > There will be a better patch to furnish a list of servers which are > autorized to logout whithout token. What do you think about? > > > > Dom
Attachment
Watch this ticket