Is it secure to activate logout form from outside the form itself?
First question on StackOverflow, so pardon me if this is a duplicate (I
did search first, I promise).
I'm building a simple back office application using ASP.NET MVC 4. The
default code for logging out uses a form in order to use the validation
feature, like so:
@using (Html.BeginForm("LogOut", "Account", FormMethod.Post, new { id =
"logoutForm" }))
{
@Html.AntiForgeryToken()
<a
href="javascript:document.getElementById('logoutForm').submit()">Log
off</a>
}
However, this leaves me with some weird styling issues with my navigation
bar. It occurred to me that I could workaround it easily by just moving
the link outside of the form, like so:
<a href="javascript:document.getElementById('logoutForm').submit()">Log
Out</a>
@using (Html.BeginForm("LogOut", "Account", FormMethod.Post, new { id =
"logoutForm" }))
{
@Html.AntiForgeryToken()
}
However, this leaves me wondering: Is this still secure?
(I think it is, but I'm new to ASP.NET so I wanted to get confirmation.)
No comments:
Post a Comment