Logout directly by hiting http://localhost:3000/logout should remove the cookie stored in the browser about indie-stack

[kayode-adechinan]

I understand much better. Thanks for the clarifications. I appreciate

[machour]

Hitting directly /logout shouldn't log you out, as it is bad practice.

If you do that, I could put an image on my website like this:
<img src="https://yourwebsite/logout" />
and have all your users logged out from your website when they visit mine.
Or a prefetch on your own website could do that.
You don't want that.

Logout should only happens with POST (action) and this is how this stack is implementing it:
https://github.com/remix-run/indie-stack/blob/main/app/routes/logout.tsx

[dvnrsn]

Edit: I see now I was confused. logout.tsx is a POST endpoint. I was mistakenly <Link>ing to it. But then I saw this in notes.tsx

        <Form action="/logout" method="post">
          <button
            type="submit"
            className="rounded bg-slate-600 px-4 py-2 text-blue-100 hover:bg-blue-500 active:bg-blue-600"
          >
            Logout
          </button>
        </Form>

I don't think it's working in the stack any more. The linked logout.tsx does have an action but the route automatically redirects. I'm assuming this is not desired