Multi tool use

.Net Core Use logout link instead of button preventig cross domain GET request

I know that using button instead of anchor link in _LoginPartial.cshtml is to prevent cross domain GET requests, but I really need using anchor link to have a uniform nav-bar links. My question is: If I use anchor tag and use javascript code to call form submit method, will it be safe and prevent cross domain GET request? I mean replacing this code:

<button type="submit">Logout</button>


with this one:

<a href="javascript:document.getElementById('logoutForm').submit()"></a>


2 Answers
2

The point about using a form there is that the form automatically includes a CSRF token. That token is what protects you against cross-site requests since it is only generated as part of the actual form, so not accessible from outside.

As long as that token is included and valid, you should be safe against CSRF. So yeah, submitting the form via JavaScript will be fine here.

Consider using a proper click event for your link though instead of javascript: links:

click

javascript:

<a id="logout-link" href="#">Logout</a>


document.getElementById('logout-link').addEventListener('click', function (evt) {
evt.preventDefault();
document.getElementById('logoutForm').submit();
});


It isn't necessary to change from a button to a link to achieve uniform nav-bar links. If you are using bootstrap you can make a button look like a link easily as shown, if not using bootstrap it is still possible to style a button to look like a link.

<button type="submit" class="btn btn-link">Logout</button>


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.