Logout should support POST Urls

Some applications might require to do a POST to logout. E.g. Gitlab recently changed to that.

See the following Gitlab issues and MRs for background:

  • Moved from GET to POST https://gitlab.com/gitlab-org/gitlab/-/merge_requests/22113
  • Reporting it needs CSFR and thus you can't use it from other apps: https://gitlab.com/gitlab-org/gitlab/-/issues/206912
  • Fixed it to not require a CSFR https://gitlab.com/gitlab-org/gitlab/-/merge_requests/25521
  • Background: https://gitlab.com/gitlab-org/gitlab-foss/-/issues/39708#note_196352617 / https://gitlab.com/gitlab-org/gitlab/-/issues/34190 / https://gitlab.com/gitlab-org/gitlab/-/issues/30454

We must therefor introduce a way that SPs can have POST URLs and then somehow submit them using JS.

The iAPI should give us back not only a list of URLs but also include the method it should happen with: iapi#2 (closed)

Then we can add a way to do a logout using POST for these methods. Or at least display a button, where folks can additionally logout.

Assignee Loading
Time tracking Loading