Make logging out be a POST request so that the CSRF token is checked

amaia · Sep 4, 2012 · 1fe0ac6 · 1fe0ac6
1 parent a799e4b
commit 1fe0ac6
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/app/views/shared/menu/_profile.haml b/app/views/shared/menu/_profile.haml
@@ -1,4 +1,5 @@
 - if current_user
   %ul.menu#profile_menu
     != menu_item("Profile", "/users/#{current_user.username}")
-    != menu_item("Log Out", "/logout")
+    %li.log_out
+      = link_to "Log Out", logout_path, :method => :post
diff --git a/config/routes.rb b/config/routes.rb
@@ -5,7 +5,7 @@
   # Sessions
   resources :sessions, :only => [:new, :create, :destroy]
   match "/login", :to => "sessions#new"
-  match "/logout", :to => "sessions#destroy"
+  match "/logout", :to => "sessions#destroy", :via => :post
 
   match "/follow", :to => "static#follow", :via => :get