Comparing
#1 with
#2
Content
[...]
This kind of CSRF exploits the fact that the logout URLs are usually unprotected.
The Logout CSRF doesn't pose major threats, but is annoying for the users.
### Logout CSRF and Yii
Yii is a very secure framework. But as of version 1.1.7, the code generated by gii"yiic webapp" isn't protected against Logout CSRF.
When you enable Yii's CSRF validation, all forms will have the validation token, thus being more protected against CSRF, but the logout link is not a form and remains unprotected.
If you want to help protect your users against this annoyance, follow the tutorial below.
Tutorial: How to get rid of Logout CSRF in Yii
----------------------------------------------[...]
34k+
