1

I am making a CMS and I have a CSRF protection in settings, new article. Should I also put this protection in the logout ?

1

Short answer: yes.

Longer answer: You should have CSRF protection EVERYWHERE where you do something which requires the permission of the current logged in user and is changing some data.

Not the answer you're looking for? Browse other questions tagged or ask your own question.