tbroyer/http-cookie-auth — Issue #2: shouldn't there also be an RFC for a best practice against CSRF?
Author: SvenDowideit
Created: 2012-02-04 06:30:27+00:00
State: open

TODO: add some words about CSRF (and find a normative reference). Mention "logout" as a mean to mitigate CSRF.