This is a followup issue to https://www.drupal.org/project/openid_connect/issues/3508791 🐛 Add CSRF protection for /user/logout Active .
In that issue, we added CSRF protection to the logout link provided by OpenID Connect. The next step is to add a confirmation form to the route to follow the Core best practices (see: https://www.drupal.org/node/3152693 → ).
1. Login with an OpenID provider.
2. Browse to `user/logout`
3. Currently receive a 403 access denied (because of the missing CSRF token).
Add the `_csrf_confirm_form_route` token to the logout route and provide the confirmation form to allow the logout action without the csrf token in the route.
[ ] Add the route option
[ ] Add the confirmation form
[ ] Add testing.
Active
3.0
Code
I was able to get this working. It took a pretty big refactor of the logout redirect. I ended up moving that logic to a separate service so that it could be reused across the new confirmation form as well as the logout controller. If anyone has some time to manually test this, that would be appreciated.
@pfrilling code review looks good.