Allow caching of the logout route

[rullzer]

It is a bit more general. If the only argument is the requesttoken. So a
get request will work with the CSRF protection. The route will be
generated without the parameters and the request token will be added at
the end.

Before the route could not properly be cached as the request token was
always changing. However now it can be cached saving precious cpu
cycles.

Noticed while looking at #13712. While #13712 is a general improvement for route generation this fixes the non caching of this specific route.

[MorrisJobke]

I really don't like that this is handled in there. I would handle it directly in the logout URL handling - just request the URL without any parameter and manually add it then. This reduces unnecessary complexity in the reused method generate() and makes it easier to understand, because no magic like this is handled.

[rullzer]

Then somebody with JS magic skills needs to tackle it

[MorrisJobke]

Then somebody with JS magic skills needs to tackle it

Why? It's PHP as well - I would just do it in here:

server/lib/private/legacy/user.php

Lines 266 to 280 in bb86a8c

	publicstaticfunctiongetLogoutUrl(\OCP\IURLGenerator$urlGenerator) {
	$backend = self::findFirstActiveUsedBackend();
	if ($backend) {
	return$backend->getLogoutUrl();
	}
	$logoutUrl = $urlGenerator->linkToRouteAbsolute(
	'core.login.logout',
	[
	'requesttoken' => \OCP\Util::callRegister(),
	]
	);
	return$logoutUrl;
	}

😉

[rullzer]

Aaaaah right ok makes sense. Let me do that then...

[nickvergessen]

🙈

[ChristophWurst]

👍 🐘 🙈

[MorrisJobke]

Still failing:

--- Expected
+++ Actual
@@ @@
- 'href' => 'https://example.com/logout'
+ 'href' => 'https://example.com/logout?requesttoken=Wq1opm+k0/NnQAydww7painntbJdUuM6gyTGbzqAOUk=:NccK4zbBgdxWcViksE2QK1+OgdksEYBW1XCVNXTZUR4='

[danxuliu]

The acceptance test failures seem legit; for me, logging out now (sometimes) results in an error page with

Access forbidden
CSRF check failed

[MorrisJobke]

😢

[rullzer]

The acceptance test failures seem legit; for me, logging out now (sometimes) results in an error page with

Access forbidden
CSRF check failed

Aaaah sometimes yes... OK I know what is going on... fix incomming