Path: csiph.com!usenet.pasdenom.info!news.etla.org!news.stack.nl!newsfeed.xs4all.nl!newsfeed3.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Return-Path: <python.list@tim.thechases.com>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.010
X-Spam-Evidence: '*H*': 0.98; '*S*': 0.00; ';-)': 0.03; 'django.': 0.05; 'cherrypy': 0.09; "django's": 0.09; 'subject:Cherrypy': 0.09; '(something': 0.16; '-tkc': 0.16; 'begging': 0.16; 'from:addr:python.list': 0.16; 'from:addr:tim.thechases.com': 0.16; 'from:name:tim chase': 0.16; 'limiting': 0.16; 'merely': 0.16; 'url:example': 0.16; 'wrote:': 0.18; 'module': 0.19; 'appears': 0.22; "haven't": 0.24; "i've": 0.25; 'performing': 0.26; 'header:In-Reply-To:1': 0.27; 'tim': 0.29; "doesn't": 0.30; 'chase': 0.31; 'minor': 0.31; 'post.': 0.31; 'talked': 0.31; 'allows': 0.31; 'open': 0.33; "i'd": 0.34; 'something': 0.35; 'but': 0.35; 'charset:us-ascii': 0.36; 'too': 0.37; 'received:10': 0.37; 'actions': 0.38; 'to:addr:python-list': 0.38; 'rather': 0.38; 'ability': 0.39; 'to:addr:python.org': 0.39; 'even': 0.60; 'skip:y 20': 0.60; 'tag': 0.61; 'skip:n 10': 0.64; 'pick': 0.64; 'talking': 0.65; 'investigated': 0.84; 'trouble.': 0.91; 'received:108': 0.93
X-Sender-Id: wwwh|x-authuser|tim@thechases.com
X-Sender-Id: wwwh|x-authuser|tim@thechases.com
X-MC-Relay: Neutral
X-MailChannels-SenderId: wwwh|x-authuser|tim@thechases.com
X-MailChannels-Auth-Id: wwwh
X-MC-Loop-Signature: 1417471310301:3219521146
X-MC-Ingress-Time: 1417471310301
Date: Mon, 1 Dec 2014 16:04:20 -0600
From: Tim Chase <python.list@tim.thechases.com>
To: python-list@python.org
Subject: Re: Cherrypy - prevent browser "prefetch"?
In-Reply-To: <m5infj$kf8$2@solani.org>
References: <6B74D6DD-A597-4BCF-8586-D0A56C9CDB77@ravnalaska.net> <mailman.16470.1417469029.18130.python-list@python.org> <m5infj$kf8$2@solani.org>
X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-AuthUser: tim@thechases.com
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.16472.1417471699.18130.python-list@python.org>
Lines: 29
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1417471699 news.xs4all.nl 2950 [2001:888:2000:d::a6]:60203
X-Complaints-To: abuse@xs4all.nl
Xref: csiph.com comp.lang.python:81780

On 2014-12-01 22:44, Christoph M. Becker wrote:
> Tim Chase wrote:
> > haven't investigated recently, but I remember Django's ability to
> > trigger a log-out merely via a GET was something that irked me.
> > 
> > All this to also say that performing non-idempotent actions on a
> > GET request is just begging for trouble. ;-)
> 
> ACK.  However, isn't log-out an idempotent action?

A minor note here...the OP talked about CherryPy and I've been in
Django-land too long that I started talking Django.  I'd have
to pick open the scabs of my CherryPy experience to answer about CP.

But yes, it appears that Django's contrib.auth module still allows
for performing a logout/ on a GET (something I remember
encountering/researching several years ago) rather than limiting it to
a POST. As best I can tell, it doesn't even check the refer(r)er, so
this charmingly means that I can put a tag like

 <img src="http://yoursite.example.com/logout/"> 

on *my* site, and it will log you out from yoursite.example.com
despite.  Not even a CSRF-token check because it's not a POST.

-tkc