CSRF and expired logout forms

Prevent users seeing a 419 Page Expired when logging out

Best practice for logging out is that the function should be driven from a form and use a csrf token to prevent someone logging you out in a CSRF attack. Forcibly logging users out may cause them to disclose login credentials whilst they are being monitored.

A problem with the CSRF token in the logout form is that it can become stale in at least the following three scenarios

  1. User has more than one tab open and logs out in one of them. The logout action on other tabs will now produce 419 Page Expired error

  2. User has a single tab open but leaves the site and does not return during the session duration. The CSRF token is then stale and pressing logout gives 419 error.

  3. The user uses the option to close all sessions on other devices. Logout on a terminated session will generate the error.

A solution to the problem is relatively simple, and requires a small addition to the VerifyCsrfToken middleware;

app/Http/Middleware/VerifyCsrfToken.php
use Closure;
//
public function handle($request, Closure $next)
{
if(!Auth::check() && $request->route()->named('logout')) {
$this->except[] = route('logout');
}
return parent::handle($request, $next);
}

Normally this file contains just an $except array of routes that should be ignored from csrf.

In this code we override the handle method and perform two checks.

  1. is the user a guest (ie, not using an authenticated session), and,

  2. is the route the logout route

If this is the case then we add 'logout' to the except array. We then pass control to the core VerifyCsrfMiddleware which recognises the presence of the logout route in the array, and bypasses the check. The form data is correctly posted and we are redirected using the LogoutResponse.

The user sees no error page.

By checking in this way, we ensure that genuine logout requests are still protected by CSRF Token.