Google is a famous example of not blocking CSRF on logout/logoff pages.
Some vulnerability reporters contact us about the ability to log out Google users by navigating their browser to a particular URL. In some ways, this behavior is undesirable, but we believe that it cannot be reliably addressed on the modern web: for example, malicious websites may also simply overflow the browser cookie jar and drop your authentication cookies for other websites on the Internet.
The as of today most popular answer to Must login and logout action have CSRF protection? disagrees, citing phishing concerns. The second most popular answer says it's not necessary, but the attack could cause inconveniences. The third answer says protection is a must.
Why does Google take a contrary stance here? Why does Google keep this stance and/or, why do so few individuals seem to agree?
Note: Numerous places online reference the fact that Google has discussed this "ad nauseum," but I didn't find the actual discussions.
Edit: It's not just Google, but many major sites do this.
Edit 2: This question is not a duplicate of Must login and logout action have CSRF protection? because I am not asking whether a page needs to have logout CSRF protection or not. I am asking
- What Google's reasoning for their stance is (they provided only a portion of their reasoning in the quoted excerpt) and
- Why there is an apparent division between Google and the answers on that question.
This question is primarily trying to unpack the reasoning for Google's security decision, a detailed case study rather than a broad treatment.