From b5fb855f1d152ef0c52d579b96c006a63e77fd10 Mon Sep 17 00:00:00 2001
Message-Id: <b5fb855f1d152ef0c52d579b96c006a63e77fd10.1714035088.git.mdw@distorted.org.uk>
From: Mark Wooding <mdw@chiark.greenend.org.uk>
Date: Thu, 23 Jan 2014 19:05:23 +0000
Subject: [PATCH] list.fhtml: Make `logout' be a POST operation.
Organization: Straylight/Edgeware

From: Mark Wooding <mdw@distorted.org.uk>

It's really not idempotent.  And also it will spam the CSRF token into
the URL, which isn't what we want.
---
 list.fhtml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/list.fhtml b/list.fhtml
index 0fb5faf..8a947aa 100644
--- a/list.fhtml
+++ b/list.fhtml
@@ -130,7 +130,7 @@
 
 <h2>Log out of Chopwood</h2>
 
-<form method=GET action="~={script}H/logout">
+<form method=POST action="~={script}H/logout">
 <button type=submit>Log out</button>
 <input type=hidden name=%user value="~={user}H">
 <input type=hidden name=%nonce value="~={nonce}H">
-- 
[mdw]