4

When I enter url :

http://www.example.com/wp-login.php?action=logout

it asks if you want to log out or not ?

why does it happen where I am not logged in as a admin?

If I run this url on any website like

http://www.example.com/wp-login.php?action=logout

The admin of that site comes to know that somebody logged out, when I just used this url, without admin username and password.

1

2 Answers 2

3

This happens because of a missing nonce parameter in the URL.

Every WordPress action, including login/logout, validates the nonce first, to make sure the request comes from a known source.

2

To further Dan's answer, in order to properly form a login or logout link, WordPress provides you two functions;

wp_login_url() and wp_logout_url() - both of which generate a URL with a nonce for you. There's actually a further helper function, wp_loginout() which provides a log in link if the user is logged and and a log out link if the user is logged in.

If you look on the screen you're presented if you just type in example.com/wp-login.php?action=logout you'll see that it generates a link that includes a nonce.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.