Monday, 9 September 2013

Is it secure to activate logout form from outside the form itself?

Is it secure to activate logout form from outside the form itself?

First question on StackOverflow, so pardon me if this is a duplicate (I
did search first, I promise).
I'm building a simple back office application using ASP.NET MVC 4. The
default code for logging out uses a form in order to use the validation
feature, like so:
@using (Html.BeginForm("LogOut", "Account", FormMethod.Post, new { id =
"logoutForm" }))
{
@Html.AntiForgeryToken()
<a
href="javascript:document.getElementById('logoutForm').submit()">Log
off</a>
}
However, this leaves me with some weird styling issues with my navigation
bar. It occurred to me that I could workaround it easily by just moving
the link outside of the form, like so:
<a href="javascript:document.getElementById('logoutForm').submit()">Log
Out</a>
@using (Html.BeginForm("LogOut", "Account", FormMethod.Post, new { id =
"logoutForm" }))
{
@Html.AntiForgeryToken()
}
However, this leaves me wondering: Is this still secure?
(I think it is, but I'm new to ASP.NET so I wanted to get confirmation.)

No comments:

Post a Comment