You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:01:56 UTC
[I] Logout is accessible via GET, enabling forced-logout attacks (tooling-trusted-releases)
andrewmusselman opened a new issue, #783:
URL: https://github.com/apache/tooling-trusted-releases/issues/783
**ASVS:** 3.5.1, 3.5.3 · **CWE:** CWE-352 · **Files:** `src/asfquart/generics.py` (lines 51–58), `atr/templates/includes/topnav.html` (line 142)
### Description
Logout is performed by navigating to `GET /auth?logout`. Session destruction is a state-changing operation and should not be on a safe HTTP method. An attacker can force logout via `<img src="https://target/auth?logout">` on any page, disrupting user workflows.
### Vulnerable code
```python
# src/asfquart/generics.py
elif logout_uri or quart.request.query_string == b"logout":
asfquart.session.clear() # state change via GET
```
```html
<!-- topnav.html -->
<a href="/auth?logout=/" class="logout-link btn btn-sm btn-secondary ms-2">Log out</a>
```
### Recommended fix
Require POST for logout and protect with CSRF:
```html
<form method="post" action="/auth/logout" class="d-inline">
{{ csrf_input|safe }}
<button type="submit" class="logout-link btn btn-sm btn-secondary ms-2">Log out</button>
</form>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Logout is accessible via GET, enabling forced-logout attacks (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #783:
URL: https://github.com/apache/tooling-trusted-releases/issues/783#issuecomment-3987171036
The suggested change to `topnav.html` gives a 405 Method Not Allowed. Further work is in `asfquart` ....
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Logout is accessible via GET, enabling forced-logout attacks (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #783:
URL: https://github.com/apache/tooling-trusted-releases/issues/783#issuecomment-4000260004
See https://github.com/apache/infrastructure-asfquart/issues/66 for the `asfquart` work.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Logout is accessible via GET, enabling forced-logout attacks (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #783:
URL: https://github.com/apache/tooling-trusted-releases/issues/783#issuecomment-4070310806
This issue is not strictly closed until https://github.com/apache/infrastructure-asfquart/issues/69 is resolved, but we (a) expect this work to be completed eventually and incorporated into ATR, and (b) consider forced-logout attacks to be unlikely to have significant security implications, and unlikely to be encountered in practice. For caution, we will track this internally and check that the resolution to issue 69 is incorporated into ATR before we leave beta.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Logout is accessible via GET, enabling forced-logout attacks (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #783: Logout is accessible via GET, enabling forced-logout attacks
URL: https://github.com/apache/tooling-trusted-releases/issues/783
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Logout is accessible via GET, enabling forced-logout attacks (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #783: Logout is accessible via GET, enabling forced-logout attacks
URL: https://github.com/apache/tooling-trusted-releases/issues/783
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Logout is accessible via GET, enabling forced-logout attacks (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #783:
URL: https://github.com/apache/tooling-trusted-releases/issues/783#issuecomment-3978401431
@andrewmusselman The POST change for `topnav.html` is trivial. In looking at `asfquart` the `generics` don't do any protocol checking and I suspect forcing `auth/logout` to be post will be rejected. Thoughts?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org