Logout should support POST Urls
Some applications might require to do a POST to logout. E.g. Gitlab recently changed to that.
See the following Gitlab issues and MRs for background:
- Moved from GET to POST https://gitlab.com/gitlab-org/gitlab/-/merge_requests/22113
- Reporting it needs CSFR and thus you can't use it from other apps: https://gitlab.com/gitlab-org/gitlab/-/issues/206912
- Fixed it to not require a CSFR https://gitlab.com/gitlab-org/gitlab/-/merge_requests/25521
- Background: https://gitlab.com/gitlab-org/gitlab-foss/-/issues/39708#note_196352617 / https://gitlab.com/gitlab-org/gitlab/-/issues/34190 / https://gitlab.com/gitlab-org/gitlab/-/issues/30454
We must therefor introduce a way that SPs can have POST URLs and then somehow submit them using JS.
The iAPI should give us back not only a list of URLs but also include the method it should happen with: iapi#2 (closed)
Then we can add a way to do a logout using POST for these methods. Or at least display a button, where folks can additionally logout.