search

WRidder / react-spa

Community site SPA based on ReactJS
http://react-spa.herokuapp.com/
MIT License
297 stars 34 forks source link

logout - http get ? #8

Closed FredericHeem closed 9 years ago

FredericHeem commented 9 years ago

For security reason, "auth/logout" should not used a http get but a http post.

WRidder commented 9 years ago

@FredericHeem Thanks for the heads up. Will look into it immediatly.

WRidder commented 9 years ago

And can you elaborate on the reason?

WRidder commented 9 years ago

I did find some background here: http://stackoverflow.com/questions/15051712/how-to-do-authentication-with-a-rest-api-right-browser-native-clients

FredericHeem commented 9 years ago

http://stackoverflow.com/questions/3521290/logout-get-or-post

WRidder commented 9 years ago

Updated, thanks @FredericHeem.

One think I'm noticing is that in Firefox (not present in Chrome) an error is logged in the console when logging out. However, it's not related to the client, it seems to originate from the post response. Any ideas what the standard response should be? At the moment in express the response is just ended with a 200 success.

FredericHeem commented 9 years ago

Thanks for the quick fix.