"user/logout" and "user/reset_password" pages are broken

[DeezjaVu]

@Fugiman

As per estrat’s post, we solved the issue with the addition of a url parameter that forces user confirmation that they’re on the correct account.

Adding a method to get the CSRF token completely negates the point of a CSRF token in the first place, and removing the CSRF check would re-open the security vulnerability that it’s meant to negate.

The issue was not solved. Adding the parameter solves nothing as the logout doesn’t work when used via an embedded browser (what Adobe AIR uses for instance). If that wasn’t clear to you yet… I donno what to say anymore.

What could possibly solve the issue, at least with the logout not working properly, is to force a login rather than trying to log the current user out. So instead of - or in addition to - a force_verify, have a force_login parameter. With that parameter set to true, an authentication would show the “login” form regardless of user status.

This would fix/bypass the logout issue and be a better user experience as users will no longer be presented with a “do you want to authorize” page for a user they already have authorized and they’d no longer have to manually click the “not me?” link.