Log out with a button, not with a link

New in Symfony 8.2 (in development). Logging out by following a link means logging out on a GET. And a GET goes out without anyone asking: a browser that prefetches the links of the page, an extension, a bot crawling the site. And any site can send its visitor to /logout: cookies follow the navigation, and the visitor is logged out.

A POST logout

We limit the logout route to POST, and the firewall checks a CSRF token (enable_csrf: true under logout). Symfony 8.2 adds what you need to render the matching form:

{{ logout_button() }}

{# a label, a firewall, attributes for the button and for the form #}
{{ logout_button('Log out', attr: { class: 'btn-link' }, form_attr: { class: 'd-inline' }) }}

logout_form() gives the action and the hidden fields (token included), to write the form yourself:

{% set logout = logout_form() %}
<form method="post" action="{{ logout.action }}">
    {% for name, value in logout.fields %}
        <input type="hidden" name="{{ name }}" value="{{ value }}">
    {% endfor %}
    <button>Log out</button>
</form>

Impersonation has its own: impersonation_button() and impersonation_exit_button().

Also new: target: ~ under logout removes the redirect after logging out, and lets the controller of the route answer, in JSON for an API for example.

Your task

The account page offers a "Log out" link (log in with ada / lovelace in the preview). Replace it with a "Log out" button: logging out only accepts POST, with a CSRF token.