omab/django-social-auth — Issue #160: CSRF issue with disconnection
Author: rossp
Created: 2011-10-12 03:03:19+00:00
State: open

The disconnection views operate on GET paramaters and don't require any sort of validation. A nasty user who knows that django-social-auth is in use could trick a user into opening /disconnect/twitter/ (for example) and lock users out of their accounts!

This isn't hard to do. Consider the attacker creating an image tag... <img src='http://mysite/disconnect/twitter/'>