Spring Security - Third Edition

Logging out

Adding CSRF will update the LogoutFilter filter to only use HTTP POST. This ensures that logging out requires a CSRF token and that a malicious user cannot forcibly log out your users.

One approach is to use a <form> tag for logout. If you want an HTML link, you can use JavaScript to have the link perform an HTTP POST (which can be in a hidden form). For browsers with JavaScript disabled, you can optionally have the link take the user to a logout confirmation page that will perform the HTTP POST.

If you want to use HTTP GET with logout, you can do so, but remember, this is generally not recommended. For example, the following Java configuration will perform logout when the logout URL pattern is requested with any HTTP method: ...