From 3207d71244ee0ffaf3fdd796c8539f6995d0620c Mon Sep 17 00:00:00 2001
From: fs <fs@breadcrumb-solutions.de>
Date: Sat, 25 Apr 2026 23:35:03 +0200
Subject: [PATCH] harden(logout): enforce POST+CSRF and remove GET logout
 triggers

---
 pages/admin/index().php                       |  2 +-
 pages/auth/logout().php                       |  7 ++++
 templates/default.phtml                       | 10 ++++-
 templates/partials/app-topbar.phtml           |  6 ++-
 .../AuthLogoutCsrfContractTest.php            | 39 +++++++++++++++++++
 web/js/components/app-session-warning.js      | 27 +++++++++++--
 6 files changed, 82 insertions(+), 9 deletions(-)
 create mode 100644 tests/Architecture/AuthLogoutCsrfContractTest.php

diff --git a/pages/admin/index().php b/pages/admin/index().php
index 05d0c04..17c4db5 100644
--- a/pages/admin/index().php
+++ b/pages/admin/index().php
@@ -13,6 +13,6 @@ $first_name = $user['first_name'] ?? '';
 Buffer::set('title', t('Admin'));
 
 $breadcrumbs = [
-    ['label' => t('Login'), 'path' => 'logout'],
+    ['label' => t('Login'), 'path' => 'login'],
     ['label' => t('Home')],
 ];
diff --git a/pages/auth/logout().php b/pages/auth/logout().php
index 9702230..3c55f51 100644
--- a/pages/auth/logout().php
+++ b/pages/auth/logout().php
@@ -1,4 +1,11 @@
 <?php
 
+if (!actionRequirePost('login')) {
+    return;
+}
+
+if (!actionRequireCsrf('login', 'login', 'logout_csrf')) {
+    return;
+}
 
 app(\MintyPHP\Service\Auth\AuthService::class)->logoutAndRedirect('login');
diff --git a/templates/default.phtml b/templates/default.phtml
index 276c301..c3cca42 100644
--- a/templates/default.phtml
+++ b/templates/default.phtml
@@ -15,6 +15,7 @@ $sessionIdleMinutes = (int) (appSetting('session_idle_timeout_minutes') ?? 30);
 $sessionIdleSeconds = max($sessionIdleMinutes, 5) * 60;
 $sessionPingUrl = lurl('admin/session-ping/data');
 $sessionLogoutUrl = lurl('logout');
+$sessionLogoutFormId = 'app-logout-form';
 $telemetryEnabled = frontendTelemetryEnabled();
 $telemetrySampleRate = frontendTelemetrySampleRate();
 $telemetryAllowedEvents = implode(',', frontendTelemetryAllowedEvents());
@@ -224,7 +225,7 @@ $componentPageConfig = [
       'selector' => '[data-app-session-warning-dialog]',
       'idleSeconds' => $sessionIdleSeconds,
       'pingUrl' => $sessionPingUrl,
-      'logoutUrl' => $sessionLogoutUrl,
+      'logoutFormId' => $sessionLogoutFormId,
       'csrfKey' => $csrfKey,
       'csrfToken' => $csrfToken,
     ],
@@ -296,7 +297,7 @@ $componentPageConfig['moduleRuntimeComponents'] = $moduleRuntimeComponents;
   <?php if ($isLoggedIn): ?>
   data-session-idle-seconds="<?php e((string) $sessionIdleSeconds); ?>"
   data-session-ping-url="<?php e($sessionPingUrl); ?>"
-  data-session-logout-url="<?php e($sessionLogoutUrl); ?>"
+  data-session-logout-form-id="<?php e($sessionLogoutFormId); ?>"
   <?php endif; ?>
   class="no-js"
   <?php if ($primaryVars !== ''): ?>style="<?php e($primaryVars); ?>" <?php endif; ?>
@@ -334,6 +335,11 @@ $componentPageConfig['moduleRuntimeComponents'] = $moduleRuntimeComponents;
     </div>
   </div>
   <div class="app-drawer-backdrop" aria-hidden="true"></div>
+  <?php if ($isLoggedIn): ?>
+    <form id="<?php e($sessionLogoutFormId); ?>" method="post" action="<?php e($sessionLogoutUrl); ?>" hidden>
+      <input type="hidden" name="<?php e($csrfKey); ?>" value="<?php e($csrfToken); ?>">
+    </form>
+  <?php endif; ?>
 
   <script src="<?php e(assetVersion('vendor/fslightbox/fslightbox.js')); ?>"></script>
   <?php require __DIR__ . '/partials/app-confirm-dialog.phtml'; ?>
diff --git a/templates/partials/app-topbar.phtml b/templates/partials/app-topbar.phtml
index eb192a4..8793af4 100644
--- a/templates/partials/app-topbar.phtml
+++ b/templates/partials/app-topbar.phtml
@@ -30,6 +30,7 @@ if ($tenantLabel === '') {
 }
 $canSwitchTenant = is_array($currentTenant) && count($availableTenants) > 1;
 $allowUserTheme = allowUserTheme();
+$logoutFormId = trim((string) ($sessionLogoutFormId ?? 'app-logout-form'));
 $layoutAuth = is_array($viewAuth['layout'] ?? null) ? $viewAuth['layout'] : [];
 $layoutNav = is_array($layoutNav ?? null) ? $layoutNav : [];
 $moduleSlots = is_array($layoutNav['moduleSlots'] ?? null) ? $layoutNav['moduleSlots'] : [];
@@ -196,9 +197,10 @@ $moduleTopbarSlots = is_array($moduleSlots['topbar.right_item'] ?? null) ? $modu
 
             <li class="app-topbar-menu-divider" role="separator"></li>
             <li class="app-topbar-menu-heading" role="presentation"><small><?php e(t('Session')); ?></small></li>
-            <li><a href="logout">
+            <li>
+              <button type="submit" form="<?php e($logoutFormId); ?>">
                 <?php e(t('Logout')); ?>
-              </a>
+              </button>
             </li>
           </ul>
         </details>
diff --git a/tests/Architecture/AuthLogoutCsrfContractTest.php b/tests/Architecture/AuthLogoutCsrfContractTest.php
new file mode 100644
index 0000000..6f3768b
--- /dev/null
+++ b/tests/Architecture/AuthLogoutCsrfContractTest.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace MintyPHP\Tests\Architecture;
+
+use PHPUnit\Framework\TestCase;
+
+class AuthLogoutCsrfContractTest extends TestCase
+{
+    use ProjectFileAssertionSupport;
+
+    public function testLogoutActionRequiresPostAndCsrf(): void
+    {
+        $content = $this->readProjectFile('pages/auth/logout().php');
+
+        $this->assertStringContainsString("actionRequirePost('login')", $content);
+        $this->assertStringContainsString("actionRequireCsrf('login', 'login', 'logout_csrf')", $content);
+    }
+
+    public function testTopbarLogoutUsesPostFormSubmitInsteadOfGetLink(): void
+    {
+        $content = $this->readProjectFile('templates/partials/app-topbar.phtml');
+
+        $this->assertStringNotContainsString('href="logout"', $content);
+        $this->assertStringContainsString('type="submit"', $content);
+        $this->assertStringContainsString('form="<?php e($logoutFormId); ?>"', $content);
+    }
+
+    public function testLayoutAndSessionWarningUseLogoutFormContract(): void
+    {
+        $layoutContent = $this->readProjectFile('templates/default.phtml');
+        $sessionWarningJs = $this->readProjectFile('web/js/components/app-session-warning.js');
+
+        $this->assertStringContainsString('\'logoutFormId\' => $sessionLogoutFormId', $layoutContent);
+        $this->assertStringContainsString('data-session-logout-form-id="<?php e($sessionLogoutFormId); ?>"', $layoutContent);
+        $this->assertStringContainsString('<form id="<?php e($sessionLogoutFormId); ?>" method="post" action="<?php e($sessionLogoutUrl); ?>" hidden>', $layoutContent);
+        $this->assertStringContainsString('requestSubmitWithFallback(form)', $sessionWarningJs);
+        $this->assertStringNotContainsString('window.location.href = config.logoutUrl', $sessionWarningJs);
+    }
+}
diff --git a/web/js/components/app-session-warning.js b/web/js/components/app-session-warning.js
index 743ee7f..16edae9 100644
--- a/web/js/components/app-session-warning.js
+++ b/web/js/components/app-session-warning.js
@@ -21,6 +21,20 @@ const toPositiveInt = (value, fallback = 0) => {
 
 const toTrimmed = (value) => String(value ?? '').trim();
 
+const requestSubmitWithFallback = (form) => {
+  if (!(form instanceof HTMLFormElement)) {
+    return false;
+  }
+
+  if (typeof form.requestSubmit === 'function') {
+    form.requestSubmit();
+    return true;
+  }
+
+  form.submit();
+  return true;
+};
+
 const resolveConfig = (runtimeConfig = {}) => {
   const root = document.documentElement;
   const config = runtimeConfig && typeof runtimeConfig === 'object' && !Array.isArray(runtimeConfig)
@@ -34,7 +48,7 @@ const resolveConfig = (runtimeConfig = {}) => {
 
   const idleSeconds = toPositiveInt(config.idleSeconds ?? root.dataset.sessionIdleSeconds, 0);
   const pingUrl = toTrimmed(config.pingUrl ?? root.dataset.sessionPingUrl);
-  const logoutUrl = toTrimmed(config.logoutUrl ?? root.dataset.sessionLogoutUrl);
+  const logoutFormId = toTrimmed(config.logoutFormId ?? root.dataset.sessionLogoutFormId);
   const csrfKey = toTrimmed(config.csrfKey ?? root.dataset.csrfKey);
   const csrfToken = toTrimmed(config.csrfToken ?? root.dataset.csrfToken);
   const selector = toTrimmed(config.selector || '[data-app-session-warning-dialog]') || '[data-app-session-warning-dialog]';
@@ -42,7 +56,7 @@ const resolveConfig = (runtimeConfig = {}) => {
   if (idleSeconds < MIN_IDLE_TIMEOUT) {
     return null;
   }
-  if (!pingUrl || !logoutUrl || !csrfKey || !csrfToken) {
+  if (!pingUrl || !logoutFormId || !csrfKey || !csrfToken) {
     warnOnce('UI_CONFIG_INVALID', 'Session warning config is incomplete', {
       module: 'session-warning',
     });
@@ -52,7 +66,7 @@ const resolveConfig = (runtimeConfig = {}) => {
   return {
     idleSeconds,
     pingUrl,
-    logoutUrl,
+    logoutFormId,
     csrfKey,
     csrfToken,
     selector,
@@ -230,7 +244,12 @@ export function initSessionWarning(root = document, runtimeConfig = {}) {
 
   const doLogout = () => {
     closeDialog();
-    window.location.href = config.logoutUrl;
+    const form = document.getElementById(config.logoutFormId);
+    if (!requestSubmitWithFallback(form)) {
+      warnOnce('UI_EL_MISSING', `Missing logout form: #${config.logoutFormId}`, {
+        module: 'session-warning',
+      });
+    }
   };
 
   const onUserInteraction = () => {