Enable CSRF on /logout

[rpoet-jh]

What?

We should see if we can remove CSRF exception for /logout.

Why?

To improve overall security.

How?

Two possibilities:

a) I think if we modified by pass-ui to do a post to /logout instead of a get, we could get rid of the exception.

b) Otherwise if we wanted to get rid of ignoreingRequestMatchers, we would have to modify requireCsrfProtectionMatcher as you suggest. I can't quite remember how different request matchers get joined and what takes precedence. In the worst case you would have to just duplicate the default csrf matcher with our exceptions added in.

Acceptance Criteria

ignoreingRequestMatchers is removed from pass-core SecurityConfiguration and logout works from pass.

Related Issues

https://sonarcloud.io/project/security_hotspots?id=eclipse-pass_pass-core&hotspots=AZPZytbAAdeY80wzvC1F