farridav / django-jazzmin

Jazzy theme for Django
https://django-jazzmin.readthedocs.io
MIT License
1.54k stars 272 forks source link

Update logout function in base.html #537

Closed 8bitaby closed 3 months ago

8bitaby commented 4 months ago

Update logout function in base.html

This commit updates the logout functionality in the base template (base.html) to improve security and adhere to best practices. The previous implementation used a simple link for logout, which could be susceptible to cross-site request forgery (CSRF) attacks.

The updated code replaces the logout link with a form submission method, utilizing the POST request with CSRF protection. This approach enhances the security of the logout functionality by ensuring that requests to the logout URL are only accepted from authorized sources, preventing potential unauthorized access or malicious actions.

Additionally, the use of a form submission method allows for better compatibility with server-side processing and future scalability. The form includes a CSRF token to mitigate CSRF attacks, providing an additional layer of security.

By making this change, we are prioritizing security and robustness in our application's authentication mechanisms, aligning with industry best practices and ensuring a safer user experience.

This commit addresses issue #536 and implements the recommended solution. Tested locally to ensure proper functionality.

sa11erto5n commented 3 months ago

i found the same error, so i created a new logout view and edited the base.html so it triggers my new view. I went to create a new pull request but since you already did i won't

jamesgilmorelyst commented 3 months ago

Duplicates https://github.com/farridav/django-jazzmin/pull/523

farridav commented 3 months ago

Closing as solved in https://github.com/farridav/django-jazzmin/pull/544 Thanks for the contribution ;)