Closed
Bug 767703
Opened 13 years ago
Closed 13 years ago
Csrf - Logout user
Categories
(Bugzilla :: User Accounts, defect)
Tracking
()
RESOLVED
WONTFIX
People
(Reporter: laurens.bal, Unassigned)
References
Details
(Keywords: sec-low, wsec-csrf)
Attachments
(1 file)
|
92 bytes,
text/plain
|
Details |
I was able to perform a csrf vulnerability to log out a user.
The logout proces should have a token to prevent this.
Laurens,
|
Reporter | |
Comment 1•13 years ago
|
||
|
||
Updated•13 years ago
|
Assignee: nobody → user-accounts
Component: General → User Accounts
OS: Windows 7 → All
Product: bugzilla.mozilla.org → Bugzilla
QA Contact: general → default-qa
Hardware: x86_64 → All
Version: Production → 4.2.1
|
|
||
Comment 2•13 years ago
|
||
I really don't want a token to log out a user. This process must remain simple. You cannot do any harm anyway. This may be annoying if someone abuses this, but harmless.
Status: UNCONFIRMED → RESOLVED
Closed: 13 years ago
Resolution: --- → WONTFIX
|
||
Updated•11 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•