When CSRF protection is enabled, which is the default, Spring Security's LogoutFilter only processes HTTP POST requests. That means logging out requires a CSRF token, so a malicious page cannot force your users to log out with a simple link or image tag. A GET logout is possible but not recommended.
The reasoning
Logout looks harmless, but forced logout is still an attack. An attacker who can make your users' browsers hit a logout URL can disrupt sessions, interfere with workflows, or chain it with other tricks. If logout were a GET request, any page could trigger it with an image tag.
The Spring Security reference says it is important to require CSRF for log out requests and that this is why the filter handles only POST by default. It also says the easiest approach is a form.
Building the button
| Option | When it fits |
|---|---|
| A form that POSTs to the logout URL | Default and simplest, works without JavaScript |
| A link that uses JavaScript to POST, perhaps through a hidden form | When design needs a link |
| A link to a confirmation page that performs the POST | When JavaScript may be disabled |
| Allow logout with any HTTP method | Possible, generally not recommended |
The reference notes that if you want a link, you can use JavaScript to have it perform a POST, and that for browsers with JavaScript disabled you can take the user to a confirmation page that does the POST.
Steps
- Keep CSRF protection on for the chain that serves browsers.
- Render logout as a form with a POST method. Server side templates normally add the token field for you.
- For a single page app, send the token in the request header with the POST.
- Do not make logout accept all methods just because a front end developer used a link.
- Test that a GET to the logout URL does not end the session.
Common mistakes
A frequent surprise is a logout link that "worked before" and now shows a 404 or a login page. The cause is almost always method, not URL. The fix is to change the control, not to loosen the filter.
Another trap is disabling CSRF globally to make a quick logout link work. That removes protection for every other unsafe request as well. For a wider view of safe session endings, see our checklist for session timeouts and server side logout.
Safeguard scans dependencies, produces SBOMs and uses reachability analysis to show which findings your code can actually reach. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Can I allow logout over GET in Spring Security?
Yes, the reference shows how to match the logout URL with any method, but it describes this as generally not recommended.
Does CSRF off change the logout method rule?
The POST only default is tied to CSRF being enabled. Turning CSRF off to get a GET logout trades away protection elsewhere.
Sources
Last reviewed: 19 October 2026.
