Use POST for session disable endpoints (signout & admin mode disable)
What does this MR do?
This MR syncs the implementation for both admin mode disable and user signout REST endpoints from GET to POST:
- In #34190 (closed) it was identified as a potential security issue of the admin mode feature that it is using
GETfor the session disable endpoint - This had originally been implemented as
DELETEfor the admin mode feature and modified on purpose to mimic the current behaviour of the devise controller for signout to useGET
In gitlab-foss#39708 (comment 196352617) it was agreed by all stakeholders that POST is a good option for signout.
Potential issues with the change
I don't foresee issues with the change in the admin mode endpoint, since it's feature flag-protected and unused outside of development. I wonder if any external integrations would have issues by switching the user logout from GET to POST.
QA flows should be ok since they rely on click events.
Related #34190 (closed), gitlab-foss#39708 (closed)
/cc @bufferoverflow @rpaik @jbroullon @reprazent @ifarkas
Screenshots
Does this MR meet the acceptance criteria?
Conformity
- Changelog entry
- Documentation (if required)
- Code review guidelines
- Merge request performance guidelines
- Style guides
- Database guides
- Separation of EE specific content
Availability and Testing
- Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
- Tested in all supported browsers
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention
@gitlab-com/gl-security/appsec - The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
- Security reports checked/validated by a reviewer from the AppSec team