From 96ee51381d57832484e4754a334e3b8f791494f4 Mon Sep 17 00:00:00 2001
From: Diane Kaplan <dianekaplan@gmail.com>
Date: Tue, 22 Oct 2024 13:34:53 -0400
Subject: [PATCH] update to force POST request for logout (django 5) (#278)

---
 mysite/familytree/templates/familytree/top_nav.html | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/mysite/familytree/templates/familytree/top_nav.html b/mysite/familytree/templates/familytree/top_nav.html
index 17f0c4b..98bd36c 100644
--- a/mysite/familytree/templates/familytree/top_nav.html
+++ b/mysite/familytree/templates/familytree/top_nav.html
@@ -41,12 +41,19 @@
               <div class="dropdown-menu">
                 <a class="dropdown-item" href="{% url 'account' %}">My Updates</a>
                 <a class="dropdown-item" href="{% url 'password_reset' %}">Reset Password</a>
-                <a class="dropdown-item" href="{% url 'logout' %}">Log out</a>
+
+                <form id="logout-form" action="{% url 'logout' %}" method="post">
+                  <a class="dropdown-item" href="#" onclick="document.getElementById('logout-form').submit(); return false;">Log out</a>
+                  {% csrf_token %}
+              </form>
               </div>
             </li>
             {% else %}
               <li class="nav-item">
-                <a class="dropdown-item" href="{% url 'logout' %}">Log out</a>
+                <form id="logout-form" action="{% url 'logout' %}" method="post">
+                  <a class="dropdown-item" href="#" onclick="document.getElementById('logout-form').submit(); return false;">Log out</a>
+                  {% csrf_token %}
+              </form>
               </li>
             {% endif %}