Add CSRF protection to "/logout"

[shahar1]

closes: #33030

cc: @potiuk, @eladkal

---

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in newsfragments.

[shahar1]

General question - Should Non-DB tests for FAB provider be skipped? (currently they fail)

[potiuk]

General question - Should Non-DB tests for FAB provider be skipped? (currently they fail)

I think by modifying logout and adding decorator, some of the tests simply started requiring database - have not looked in detail, but that's essentially what is happening here. I guess it can be fixed by changing the test code to not trigger DB operations in those tests (preferrable) or marking them as db_tests.

[shahar1]

General question - Should Non-DB tests for FAB provider be skipped? (currently they fail)

I think by modifying logout and adding decorator, some of the tests simply started requiring database - have not looked in detail, but that's essentially what is happening here. I guess it can be fixed by changing the test code to not trigger DB operations in those tests (preferrable) or marking them as db_tests.

It makes sense, I'll check it out

[potiuk]

I think we also need a newsfragment for that one. While it can be treated as 'security fix" it also potentially breaks somoene workflow if they have some non-CSRF logout integrated somewhere in their setup.

[shahar1]

I think we also need a newsfragment for that one. While it can be treated as 'security fix" it also potentially breaks somoene workflow if they have some non-CSRF logout integrated somewhere in their setup.

I will add one.
I also checked locally - I managed to reproduce the errors, with or without the change, when running the following command:
breeze testing non-db-tests --parallel-test-types "Always Providers[fab] WWW"

So I see no other good choice, but marking test_role_and_permission_endpoint.py as a db test.

[potiuk]

So I see no other good choice, but marking test_role_and_permission_endpoint.py as a db test.

Yep. Saw the marker. Indeed that's simpler.