Fixed #15619 -- Deprecated log out via GET requests.

Thanks Florian Apolloner for the implementation idea.

Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>

1 files changed, 21 insertions, 4 deletions

diff --git a/django/contrib/auth/views.py b/django/contrib/auth/views.py
index 6de053f492..f86debde00 100644
--- a/django/contrib/auth/views.py
+++ b/django/contrib/auth/views.py
@@ -1,3 +1,4 @@
+import warnings
 from urllib.parse import urlparse, urlunparse
 
 from django.conf import settings
@@ -21,6 +22,7 @@ from django.http import HttpResponseRedirect, QueryDict
 from django.shortcuts import resolve_url
 from django.urls import reverse_lazy
 from django.utils.decorators import method_decorator
+from django.utils.deprecation import RemovedInDjango50Warning
 from django.utils.http import url_has_allowed_host_and_scheme, urlsafe_base64_decode
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.cache import never_cache
@@ -117,23 +119,38 @@ class LogoutView(SuccessURLAllowedHostsMixin, TemplateView):
     Log out the user and display the 'You are logged out' message.
     """
 
+    # RemovedInDjango50Warning: when the deprecation ends, remove "get" and
+    # "head" from http_method_names.
+    http_method_names = ["get", "head", "post", "options"]
     next_page = None
     redirect_field_name = REDIRECT_FIELD_NAME
     template_name = "registration/logged_out.html"
     extra_context = None
 
+    # RemovedInDjango50Warning: when the deprecation ends, move
+    # @method_decorator(csrf_protect) from post() to dispatch().
     @method_decorator(never_cache)
     def dispatch(self, request, *args, **kwargs):
+        if request.method.lower() == "get":
+            warnings.warn(
+                "Log out via GET requests is deprecated and will be removed in Django "
+                "5.0. Use POST requests for logging out.",
+                RemovedInDjango50Warning,
+            )
+        return super().dispatch(request, *args, **kwargs)
+
+    @method_decorator(csrf_protect)
+    def post(self, request, *args, **kwargs):
+        """Logout may be done via POST."""
         auth_logout(request)
         next_page = self.get_next_page()
         if next_page:
             # Redirect to this page until the session has been cleared.
             return HttpResponseRedirect(next_page)
-        return super().dispatch(request, *args, **kwargs)
+        return super().get(request, *args, **kwargs)
 
-    def post(self, request, *args, **kwargs):
-        """Logout may be done via POST."""
-        return self.get(request, *args, **kwargs)
+    # RemovedInDjango50Warning.
+    get = post
 
     def get_next_page(self):
         if self.next_page is not None: