Thanks for your returns, I'm working on it.

I wonder if there should be a way to bypass CSRF? One of the use cases where I've needed programmatic logout is when handling user invitations.. There if you click the invite email and you are already logged in we show "accept invite" or "create new account". If you click that we log you out and send you back to the invite page which then shows a registration form.

In this case, we authenticate the request has the token from the email anyway, and we absolutely do not need a CSRF token.. Of course we could add one on the "create new account" button I guess if needed, just doesn't seem necessary.

I think most use cases for this method are in similar situations. I'll think of a way to bypass it, will probably end up with a bool parameter. Thanks!

@chalasr thanks, LGTM now I think - haven't reviewed the whole code in depth though, but on the surface the API makes sense to me.

I'm not 100% sure, but I'm leaning towards not allowing to bypass CSRF. If an application enabled logout CSRF as a way to prevent login csrf, I would expect all ways of logging out to be protected by CSRF. With this boolean, I no longer can be sure.

Of course, @Seldaek understands login CSRF and knows that CSRF would only be "added noise" in this specific scenario, but I think the framework has a duty to protect those unaware of login CSRF to be as safe as possible.

CSRF protection is pointless if logout happens on a GET request, or as a side effect of a state change of another resource which might itself already be CSRF protected using a different token, or Jordi's use case.
I strongly think such cases are the ones for which this method makes the most sense instead of requesting a regular logout endpoint, I would find it too bad to force dealing with it while it's not needed

Yeah IMO there's a clear need for the bypass.. But I could live with csrf being enabled by default instead of bypassed by default.

I think that having the default value (for CSRF validation) set to true by default is enough for me as it forces a conscious decision from the developer.

Thank you @johnkrovitch.

You're welcome. Thank you all