An application has a multifactor login. The user logs in with its e-mail and password, and then the following screen asks for a one time password received via e-mail or generated by a mobile app.
In that second screen there's also a link called "cancel login" that points to, for example
/login/cancel. The user can click this to cancel the login process and the sessions/cookies for the process are cleaned up and you would have to start over.
My question is about this kind of 'action' links. Clicking it actually sends a
GET request, but not for just displaying a page or retrieving data, but for performing an action in the application. In practice, another website could contain a link or even an image that points to the "login cancel url" of our application and logout unknowing users.
Simply said, a CSRF attack.
I use the Laravel PHP framework, and use the built-in CSRF protection for html forms. But I wonder how to implement this protection for
GET requests properly. Would it be sufficient to add a query parameter to the url of the action link, and then manually verify the included CSRF token?
Also, I wonder if it is acceptable anyway to use links for executing an action in a web application. It works well, but a
GET request is semantically not intended for 'saying/executing'.
One alternative is that I don't use links but a small form containg a hidden CSRF token field and a submit button that acts as (and is styled as) a link. The form is sent using a
POST request then.
What are best practises and are there any security guidelines?