[SHIRO-595] Allow for POST only logout requests

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0-RC2
• Assignee: Brian Demers
• Reporter: Brian Demers
• Created: 21/Oct/16 14:15
• Updated: 21/Oct/16 14:55
• Resolved: 21/Oct/16 14:55

Description

See:
http://stackoverflow.com/questions/3521290/logout-get-or-post

A logout causes a change of state, so should NOT be a GET.

Also, due to browser pre-fetching, a typing http://localhost:8080/log may cause a prefetch to /logout

To stay backwards compatible, this need to be an op-in feature.

The proposed solution set a shiro.postOnlyLogout = true attribute, (same as logout.postOnlyLogout = true)