Add CSRF protection for /user/logout

Thanks for the report. Working on this today.

CSRF protection and tests confirming have been added to the logout route.

I think we create a follow up issue to introduce the _csrf_confirm_form_route that mimics the OpenIDConnectRedirectController::redirectLogout. That seemed like a bigger refactor and likely warrants a separate issue.

I applied the patch.

The user/logout route now returns a 403.

This is the logical behavior, but is it the expected behavior?

Shouldn't we have the confirmation form?

@jibus, Yes, I do think we need to add the confirmation form to match core's workflow, but I was planning on doing that work in a separate issue.

@pfrilling You specified it, my bad.

I'm marking this as RTBC from @jibus's review in #5.

Code has been merged and the followup issue has been created to add the confirmation form here: https://www.drupal.org/project/openid_connect/issues/3518252

I just wanted to post a heads up here. It looks like this change is for some reason causing a 403 error when a currently-logged-in user visits /user/logout on D11.

Thanks @attheshow. That is expected as the route requires a csrf token. Browsing directly to that route won't have the token, hence the 403. If you use the logout link provided by a menu and/or the login block, it should work. The followup issue #3518252: Add _csrf_confirm_form_route option for to the user/logout route will get that direct link remedied with a confirmation form.

OK, I'll go ahead and put together a patch for our site so that we can continue to use our existing logout links on D11.

The confirmation form logic is in place here: https://www.drupal.org/project/openid_connect/issues/3518252.

@attheshow, are you able to manually test that MR and confirm if it works for your use case?

Sorry, I haven't been able to test that just yet.