Shib SP: how to prevent the user from initiating logout by entering URL in address bar?

[Peter Schober]

* Andrew Webb <andrew.webb at statpro.com> [2014-06-12 11:16]:
> />> What's the problem you're trying to solve?/
> 
> My understanding of HTTP is that GETs shouldn't cause state changes on the
> server.  They are just for reads.  So in the browser context, only a POST
> should cause a server state change.

OK, but what's the *problem* you're trying to solve?

> />>Why would you want to prevent me fro ending the Shib SP's session on your
> webserver?/
> 
> I want you to click on our Logout button which will POST to the server (with
> anti-CSRF measures), and then the server will peform the logout.

I got that. But why, what does this achieve compared to the status
quo? (Yes, it will achieve turning a GET into a POST but what does
/changing that behaviour/ achieve?)

Anyway, you now know that the current implementation does not do what
you wish it did. Feel free to suggest changes on the dev list and
follow them up with code contributions, so the software can be made to
behave more like you'd preferred it did.
-peter