Add CSRF protection to "/logout"

[potiuk]

Body

The /logout endpoint has no CSRF protection. This is not a security issue, because the user is logged out when the CSRF protection is in-place, but it is a potential issue as the user might get logged out by a 3rd-party tab opened (potentially),

Would be great to take a look and fix it.

Committer

• I acknowledge that I am a maintainer/committer of the Apache Airflow project.

[moulibrota-das]

I am new to this project and quiet interested in this issue. Can you help me locate the endpoint. I couldn't find it.

[potiuk]

I think it comes with Flask Application Builder.

[hterik]

Will this interfere with single-sign-out, when using Oauth2 or Saml login?
If a user logs out from the IDP, the IDP somehow need to notify Airflow to clear the the session, that's done by configuring a logout-url in the IDP.

[veginati]

@potiuk is this issue resolved ? or can I give it a try ?

[veginati]

@potiuk could you pleas assign any good first issue tickets.

[potiuk]

Not solved - give it a try. Generally look for good first issues and pick some that you think will be good for you. It's hard to give individual advices.