Sign out have to use POST

[notramo]

The generated auth app uses GET for signout. This has the following disadvantages.

• An attacker can easily sign out anyone by simply redirecting the user from a malicious site to the sign-out endpoint with a simple HTTP 3xx redirect.
• Turbo automatically prefetch <a> tag hrefs on mouseenter event, so when the user moves the mouse over the sign-out button, they are signed out.

I recommend using an empty <form> with only a CSRF token, and a <button>.

[ellmetha]

Technically, an even better strategy would be to use DELETE requests. But ultimately I agree with this and I think we can address this for the next major release.

[notramo]

Is it possible to have DELETE request with form submits? Does Marten support _method field in forms?

[ellmetha]

Does Marten support _method field in forms?

It doesn't at the moment but this could be a nice addition to the framework.