Use logout_path() helper + add CSRF protection to logout

Author: wouterj

config/packages/security.yaml

@@ -50,6 +50,10 @@ security:
                 # The name of the route to redirect to after logging out
                 target: homepage
 
+                # Secure the logout against CSRF
+                csrf_parameter: logout
+                csrf_token_generator: security.csrf.token_manager
+
             # needed because in tests we redefine the 'main' firewall to use
             # HTTP Basic instead of the login form, so this firewall has
             # multiple authenticators

templates/base.html.twig

@@ -83,7 +83,7 @@
                                             </li>
                                             <li class="divider"></li>
                                             <li>
-                                                <a href="{{ path('security_logout') }}">
+                                                <a href="{{ logout_path() }}">
                                                     <i class="fa fa-sign-out" aria-hidden="true"></i> {{ 'menu.logout'|trans }}
                                                 </a>
                                             </li>