Logout URL performing strange

Question

When I enter url :

http://www.example.com/wp-login.php?action=logout

it asks if you want to log out or not ?

why does it happen where I am not logged in as a admin?

If I run this url on any website like

http://www.example.com/wp-login.php?action=logout

The admin of that site comes to know that somebody logged out, when I just used this url, without admin username and password.

Answer 1

This happens because of a missing nonce parameter in the URL.

Every WordPress action, including login/logout, validates the nonce first, to make sure the request comes from a known source.

Answer 2

To further Dan's answer, in order to properly form a login or logout link, WordPress provides you two functions;

wp_login_url() and wp_logout_url() - both of which generate a URL with a nonce for you. There's actually a further helper function, wp_loginout() which provides a log in link if the user is logged and and a log out link if the user is logged in.

If you look on the screen you're presented if you just type in example.com/wp-login.php?action=logout you'll see that it generates a link that includes a nonce.